SnapMirror active sync supports transparent application failover for AIX

SnapMirror active sync for symmetric active/active supports transparent failover with zero RPO for AIX on 2-node clusters.

SnapMirror cloud support limits are increased to 100 S3 buckets

SnapMirror cloud increases the number of S3 buckets supported to 100.

SnapMirror synchronous supports tamperproof snapshot locking

You can use tamperproof snapshot locking with SnapMirror synchronous.

SnapMirror synchronous supports replicating scheduled snapshots to the destination volume

You can replicate scheduled snapshots to the destination volume with SnapMirror synchronous.

SnapMirror active sync support for NAS

SnapMirror active sync supports NAS workloads at the SVM level using NFS and SMB on AFF clusters (2-node only) or AFX clusters (4-node only) and read-write access only on the primary.

NAS performance enhancement

ONTAP 9.19.1 allows more CPU resources to process listing requests of small NAS directories. This enhancement benefits customers with hundreds to thousands of clients simultaneously listing the same small NAS directory, sized at 2 MB or less (approximately 25,000 files).

This enhancement reduces the need to use workarounds, such as local FlexCache volumes, to support high client counts performing directory listings. For lower client counts, performance will not be negatively impacted. This performance enhancement is automatic and does not require configuration.

Manage the NFS versions that the SVM supports

NFSv4.2 support is managed independently of NFSv4.1 settings, allowing each SVM to advertise or suppress NFSv4.2 capabilities as needed. By default, NFSv4.2 is enabled when a new NFS service is created unless explicitly disabled by the administrator.

LIF failover enhancement

The ONTAP system-defined failover group policy dynamically expands the failover targets for NAS data LIFs to potentially include any available ports in the broadcast domain on any available node in the cluster. You can apply the system-defined policy to any failover group. Prior to ONTAP 9.19.1, LIFs with this policy could fail over to only one other node in the cluster; if that node was out of quorum, the LIF would not failover, even if there were other nodes available.

TCP performance improvements

ONTAP improves TCP data transfer performance over lossy, high-latency WAN links by integrating two loss-recovery features, PRR and RACK, into the ONTAP TCP stack. PRR is suitable for all networks and is enabled by default. RACK is suitable for congested networks with link speeds of approximately 25 Gigabits/second and is disabled by default.

Support for direct-attachment FC configurations

FC switches are not needed to connect FC and FC-NVMe hosts to ONTAP storage. Hosts can connect directly to FC adapter ports on AFF, ASA, and FAS systems. This direct attachment is especially useful in remote sites and hybrid environments where simplicity is important.

Support for active-active multipathing on AFF systems

AFF systems support active-active multipathing in SAN environments. In active-active configurations, all paths within the HA pair that owns the LUN or namespace are active-optimized so that in the event of a storage failover, the host does not need to wait for the ALUA or ANA transition of the failover paths to resume I/O. This reduces time to failover allowing SAN customers to run mission-critical workloads on AFF systems with the same non-disruptive path resiliency and load balancing previously available only on ASA systems.

Enhanced support for automatic SAN LIF failover

Automatic LIF failover is supported on AFF and ASA systems for iSCSI protocol LIFs in active-active and active-active-scsi-only multipath configurations and for NVMe/TCP protocol LIFS in active-active multipath configurations.

Foreign LUN import support for iSCSI protocol

Foreign LUN Import (FLI) supports the iSCSI protocol for backend connectivity.

ONTAP S3 support for conditional writes and deletes with enforcement

You can use conditions to enforce conditional writes for object uploads and conditional deletes for object deletes. Conditional writes and deletes provide a way to prevent overwrites or unintended deletes of objects.

ONTAP S3 keys

To maintain user access to S3 resources if the original access key expires, ONTAP cluster administrators can generate a second access key for each S3 user.

ARP workload characteristics removed from System Manager UI

System Manager no longer displays Autonomous Ransomware Protection (ARP) workload characteristics, including baseline and surge statistics. This information has been removed as surge activity was frequently misinterpreted as an actual ransomware attack or as something that required manual adjustment.

ARP behavior and detection are unchanged, and only the System Manager presentation of these details is affected. Surge statistics remain available using ONTAP CLI and ONTAP REST API options for advanced analysis

TLS offload configuration

You can configure TLS offload to improve TLS post-handshake performance by leveraging resources on supported Ethernet cards. This feature offloads encryption and decryption, reducing CPU overhead and improving performance.

Enable NFS over TLS to encrypt NFS traffic in transit

You can enable NFS over TLS with TLS 1.3 to encrypt NFS traffic in transit on NFS-enabled SVMs. This enhancement helps protect NFS data from interception or tampering on untrusted networks. The release also supports optional per-LIF mutual TLS host authentication and export-policy controls to deny non-TLS TCP access for matching clients.

Autonomous Ransomware Protection support for SnapMirror synchronous and SnapMirror active sync

ARP/AI protects primary volumes in SnapMirror synchronous (NAS and SAN) relationships on FAS, AFF, and AFX systems, and in SnapMirror active sync SAN relationships on AFF and ASA r2 systems. Detection runs on the active read-write primary, where ARP snapshots are created (snapshots are not replicated).

Clusters upgraded to ONTAP 9.19.1 that previously had default ARP enablement suppressed due to synchronous replication relationships will have it automatically restored. A pre-update warning notifies administrators and provides the option to disable it.

WebAuthn Relying Party domain enhancement

ONTAP 9.19.1 introduces a new parameter -rp-domains in the WebAuthn global settings command, which allows administrators to explicitly restrict the set of permitted Relying Party (RP) domains accepted during WebAuthn (FIDO2) multi-factor authentication in System Manager.

Enhanced volume space reporting

You can use the volume show-space command to view details about space usage within a volume. Beginning with ONTAP 9.19.1, the directory used for the space reporting is included in the command output.

Support for modifying default settings that control automatic QoS throughput ceiling increases

You can modify the default settings that control how QoS policy groups automatically increase the QoS throughput ceiling in response to short-term needs for higher performance. These settings cannot be modified in ONTAP 9.18.1 and earlier.

Monitor and manage the SVM using the new ONTAP System Manager dashboard

A new, dedicated dashboard lets SVM administrators monitor and manage their own SVMs. This is particularly useful in a tenanted ONTAP environment, where the cluster administrator can provide an SVM dashboard for each tenant.

Enhanced reporting for automated upgrade pre-checks

When executing automated pre-upgrade checks, errors and warning are displayed separately to help you easily identify issues that must be resolved before you upgrade.