Skip to main content

Commit snapshots to WORM on a vault destination

Contributors netapp-lenida netapp-aaron-holt netapp-dbagwell netapp-mwallis netapp-ahibbard
PDFs

You can use SnapLock for SnapVault to WORM-protect snapshots on secondary storage. You perform all of the basic SnapLock tasks on the vault destination. The destination volume is automatically mounted read-only, so there is no need to explicitly commit the snapshots to WORM.

Before you begin

  • If you want to use System Manager to configure the relationship, both the source and the destination clusters must be running ONTAP 9.15.1 or later.

  • On the destination cluster:

  • The protection policy must be of type "vault".

  • The source and destination aggregates must be 64-bit.

  • The source volume cannot be a SnapLock volume.

  • If you are using the ONTAP CLI, the source and destination volumes must be created in peered clusters and SVMs.

About this task

The source volume can use NetApp or non-NetApp storage. For non-NetApp storage, you must use FlexArray Virtualization.

Note You cannot rename a snapshot that is committed to the WORM state.

You can clone SnapLock volumes, but you cannot clone files on a SnapLock volume.

Note LUNs are not supported in SnapLock volumes. LUNs are supported in SnapLock volumes only in scenarios where snapshots created on a non-SnapLock volume are transferred to a SnapLock volume for protection as part of SnapLock vault relationship. LUNs are not supported in read/write SnapLock volumes. Tamperproof snapshots, however, are supported on both SnapMirror source volumes and destination volumes that contain LUNs.

Beginning with ONTAP 9.10.1, SnapLock and non-SnapLock volumes can exist on the same aggregate; therefore, you are no longer required to create a separate SnapLock aggregate if you are using ONTAP 9.10.1. You use the volume '-snaplock-type' option to specify a Compliance or Enterprise SnapLock volume type. In ONTAP releases earlier than ONTAP 9.10.1, the SnapLock mode, Compliance or Enterprise, is inherited from the aggregate. Version-flexible destination volumes are not supported. The language setting of the destination volume must match the language setting of the source volume.

A SnapLock volume that is a vault destination has a default retention period assigned to it. The value for this period is initially set to a minimum of 0 years for SnapLock Enterprise volumes and a maximum of 30 years for SnapLock Compliance volumes. Each NetApp snapshot is committed with this default retention period at first. The retention period can be extended later, if needed. For more information, see Set retention time overview.

Beginning with ONTAP 9.14.1, you can specify retention periods for specific SnapMirror labels in the SnapMirror policy of the SnapMirror relationship so that the replicated snapshots from the source to the destination volume are retained for the retention-period specified in the rule. If no retention period is specified, the default-retention-period of the destination volume is used.

Beginning with ONTAP 9.13.1, you can instantaneously restore a locked snapshot on the destination SnapLock volume of a SnapLock vault relationship by creating a FlexClone with the snaplock-type option set to non-snaplock and specifying the snapshot as the "parent-snapshot" when executing the volume clone creation operation. Learn more about creating a FlexClone volume with a SnapLock type.

For MetroCluster configurations, you should be aware of the following:

  • You can create a SnapVault relationship only between sync-source SVMs, not between a sync-source SVM and a sync-destination SVM.

  • You can create a SnapVault relationship from a volume on a sync-source SVM to a data-serving SVM.

  • You can create a SnapVault relationship from a volume on a data-serving SVM to a DP volume on a sync-source SVM.

The following illustration shows the procedure for initializing a SnapLock vault relationship:

This illustration shows the procedure for initializing a SnapLock vault relationship: identifying the destination cluster

Steps

You can use the ONTAP CLI to create a SnapLock vault relationship or, beginning with ONTAP 9.15.1, you can use System Manager to create a SnapLock vault relationship.

System Manager

  1. If the volume doesn't already exist, on the source cluster, navigate to Storage > Volumes and select Add.

  2. In the Add Volume window, choose More Options.

  3. Enter the volume name, size, export policy and share name.

  4. Save your changes.

  5. On the destination cluster, navigate to Protection > Relationships.

  6. Above the Source column, select Protect and choose Volumes from the menu.

  7. In the Protect volumes window, choose Vault as the protection policy.

  8. In the Source section, select the cluster, storage VM, and volume you want to protect.

  9. In the Destination section, under Configuration details, select Lock destination snapshots, and then choose SnapLock for SnapVault as the locking method. Locking method is not displayed if the policy type selected is not of type vault, if the SnapLock license is not installed, or if the Compliance Clock is not initialized.

  10. If it is not already enabled, select Initialize SnapLock Compliance Clock.

  11. Save your changes.

Related information

Cluster and SVM peering

Volume backup using SnapVault