Skip to main content

Prepare to configure ONTAP Cloud Mediator

Contributors netapp-lenida
PDFs

Before you configure ONTAP Cloud Mediator, you must ensure that the prerequisites are met.

Firewall requirements

The firewall setting on the domain controller must allow HTTPS traffic to api.bluexp.netapp.com from both clusters.

Proxy server requirements

If you use proxy servers for SnapMirror active sync, ensure the proxy servers are created and you have the following proxy server information:

  • HTTPS proxy IP

  • Port

  • Username

  • Password

Latency

The recommended ping latency between the NetApp Console cloud server and SnapMirror active sync cluster peers is less than 200 ms.

Root CA certificates

Check the cluster for certificates

ONTAP comes with well-known root CA certificates pre-installed so in most cases you do not need to install the NetApp Console server's root CA certificate. Before you begin the ONTAP Cloud Mediator configuration, you can check the cluster to verify that the certificates exist:

Example:

C1_cluster% openssl s_client -showcerts -connect api.bluexp.netapp.com:443 -servername api.bluexp.netapp.com | egrep "s:|i:"

depth=4 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
verify error:num=19:self-signed certificate in certificate chain
verify return:1
depth=4 C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
verify return:1
depth=3 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
verify return:1
depth=2 C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root R46
verify return:1
depth=1 C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA OV R36
verify return:1
depth=0 C=US, ST=California, O=NetApp, Inc., CN=cloud.netapp.com
verify return:1
 0 s:C=US, ST=California, O=NetApp, Inc., CN=cloud.netapp.com
   i:C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA OV R36
 1 s:C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA OV R36
   i:C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root R46
 2 s:C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root R46
   i:C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
 3 s:C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
   i:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
 4 s:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
   i:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services

C1_cluster::> security certificate show -common-name Sectigo*|USERTrust*|AAA*
Vserver    Serial Number   Certificate Name                       Type
---------- --------------- -------------------------------------- ------------
C1_sti245-vsim-ocvs024k_1775534714 42F2CCDA1B6937445F15FE752810B8F4 SectigoPublicServerAuthenticationRootE46 server-ca
    Certificate Authority: Sectigo Public Server Authentication Root E46
          Expiration Date: Wed Mar 21 19:59:59 2046

C1_sti245-vsim-ocvs024k_1775534714 758DFD8BAE7C0700FAA925A7E1C7AD14 SectigoPublicServerAuthenticationRootR46 server-ca
    Certificate Authority: Sectigo Public Server Authentication Root R46
          Expiration Date: Wed Mar 21 19:59:59 2046

C1_sti245-vsim-ocvs024k_1775534714 5C8B99C55A94C5D27156DECD8980CC26 USERTrustECCCertificationAuthority server-ca
    Certificate Authority: USERTrust ECC Certification Authority
          Expiration Date: Mon Jan 18 18:59:59 2038

C1_sti245-vsim-ocvs024k_1775534714 01FD6D30FCA3CA51A81BBC640E35032D USERTrustRSACertificationAuthority server-ca
    Certificate Authority: USERTrust RSA Certification Authority
          Expiration Date: Mon Jan 18 18:59:59 2038
Check proxy server for installed certificates

If you are using a proxy to connect to the ONTAP Cloud Mediator service in the NetApp Console, ensure that the proxy server's root CA certificates are installed in ONTAP:

Example:

C1_cluster% openssl s_client -showcerts -proxy <ip:port> -connect api.bluexp.netapp.com:443 -servername api.bluexp.netapp.com |egrep "s:|i:"
Download the CA certificate:

If necessary, you can download the root-CA certificates from the certificate authority's website and install them on the clusters.

Example:

C1_cluster::> security certificate install -type server-ca -vserver C1_cluster

C2_cluster::> security certificate install -type server-ca -vserver C2_cluster