NetApp ASA C250 Instruction sheet

Maintain
Install and maintain
NetApp
October 20, 2023
This PDF was generated from https://docs.netapp.com/us-en/ontap-systems/asa-c250/maintain-
overview.html on October 20, 2023. Always check docs.netapp.com for the latest.

Table of Contents
Maintain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê1
Maintain ASA C250 hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê1
Boot media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê2

Maintain
Maintain ASA C250 hardware
For the ASA C250 storage system, you can perform maintenance procedures on the
following components.
Boot media
The boot media stores a primary and secondary set of boot image files that the system uses when it boots.
Chassis
The chassis is the physical enclosure housing all the controller components such as the controller/CPU unit,
power supply, and I/O.
Controller
A controller consists of a board, firmware, and software. It controls the drives and implements the ONTAP
functions.
DIMM
You must replace a DIMM (dual in-line memory module) when a memory mismatch is present, or you have a
failed DIMM.
Drive
A drive is a device that provides the physical storage media for data.
Fan
The fan cools the controller.
Mezzanine card
A Mezzanine card is a printed circuit board that plugs directly into another plug-in card.
NVEM battery
A battery is included with the controller and preserves cached data if the AC power fails.
Power supply
A power supply provides a redundant power source in a controller shelf.
Real-time clock battery
A real time clock battery preserves system date and time information if the power is off.
1

Boot media
Overview of boot media replacement - ASA C250
The boot media stores a primary and secondary set of system (boot image) files that the
system uses when it boots.
Before you begin
•You must have a USB flash drive, formatted to MBR/FAT32, with the appropriate amount of storage to hold
the image_xxx.tgz file.
•You also must copy the image_xxx.tgz file to the USB flash drive for later use in this procedure.
About this task
•The nondisruptive and disruptive methods for replacing a boot media both require you to restore the var
file system:
◦For nondisruptive replacement, the HA pair must be connected to a network to restore the var file
system.
◦For disruptive replacement, you do not need a network connection to restore the var file system, but
the process requires two reboots.
•You must replace the failed component with a replacement FRU component you received from your
provider.
•It is important that you apply the commands in these steps on the correct controller:
◦The impaired node is the controller on which you are performing maintenance.
◦The healthy node is the HA partner of the impaired controller.
Check onboard encryption keys - ASA C250
Prior to shutting down the impaired controller and checking the status of the onboard
encryption keys, you must check the status of the impaired controller, disable automatic
giveback, and check which version of ONTAP is running on the system.
If you have a cluster with more than two nodes, it must be in quorum. If the cluster is not in quorum or a healthy
controller shows false for eligibility and health, you must correct the issue before shutting down the impaired
controller; see the Synchronize a node with the cluster.
Steps
1. Check the status of the impaired controller:
◦If the impaired controller is at the login prompt, log in as admin.
◦If the impaired controller is at the LOADER prompt and is part of HA configuration, log in as admin on
the healthy controller.
◦If the impaired controller is in a standalone configuration and at LOADER prompt, contact
mysupport.netapp.com.
2. If AutoSupport is enabled, suppress automatic case creation by invoking an AutoSupport message:
system node autosupport invoke -node * -type all -message
MAINT=number_of_hours_downh
2

The following AutoSupport message suppresses automatic case creation for two hours: cluster1:*>
system node autosupport invoke -node * -type all -message MAINT=2h
3. Check the version of ONTAP the system is running on the impaired controller if up, or on the partner
controller if the impaired controller is down, using the version -v command:
◦If <lno-DARE> or <1Ono-DARE> is displayed in the command output, the system does not support
NVE, proceed to shut down the controller.
◦If <lno-DARE> is not displayed in the command output, and the system is running ONTAP 9.6 or later,
go to the next section.
4. If the impaired controller is part of an HA configuration, disable automatic giveback from the healthy
controller: storage failover modify -node local -auto-giveback false or storage
failover modify -node local -auto-giveback-after-panic false
Check NVE or NSE on systems running ONTAP 9.6 and later
Before shutting down the impaired controller, you need to verify whether the system has either NetApp Volume
Encryption (NVE) or NetApp Storage Encryption (NSE) enabled. If so, you need to verify the configuration.
1. Verify whether NVE is in use for any volumes in the cluster: volume show -is-encrypted true
If any volumes are listed in the output, NVE is configured and you need to verify the NVE configuration. If
no volumes are listed, check whether NSE is configured and in use.
2. Verify whether NSE is configured and in use: storage encryption disk show
◦If the command output lists the drive details with Mode & Key ID information, NSE is configured and
you need to verify the NSE configuration and in use.
◦If no disks are shown, NSE is not configured.
◦If NVE and NSE are not configured, no drives are protected with NSE keys, it’s safe to shut down the
impaired controller.
Verify NVE configuration
1. Display the key IDs of the authentication keys that are stored on the key management servers: security
key-manager key query
After the ONTAP 9.6 release, you may have additional key manager types. The types are
KMIP, AKV, and GCP. The process for confirming these types is the same as confirming
external or onboard key manager types.
◦If the Key Manager type displays external and the Restored column displays yes, it’s safe to shut
down the impaired controller.
◦If the Key Manager type displays onboard and the Restored column displays yes, you need to
complete some additional steps.
◦If the Key Manager type displays external and the Restored column displays anything other than
yes, you need to complete some additional steps.
◦If the Key Manager type displays onboard and the Restored column displays anything other than
yes, you need to complete some additional steps.
2. If the Key Manager type displays onboard and the Restored column displays yes, manually back up
3

the OKM information:
a. Go to advanced privilege mode and enter ywhen prompted to continue: set -priv advanced
b. Enter the command to display the key management information: security key-manager onboard
show-backup
c. Copy the contents of the backup information to a separate file or your log file. You’ll need it in disaster
scenarios where you might need to manually recover OKM.
d. Return to admin mode: set -priv admin
e. Shut down the impaired controller.
3. If the Key Manager type displays external and the Restored column displays anything other than
yes:
a. Restore the external key management authentication keys to all nodes in the cluster: security key-
manager external restore
If the command fails, contact NetApp Support.
mysupport.netapp.com
b. Verify that the Restored column equals yes for all authentication keys: security key-manager
key query
c. Shut down the impaired controller.
4. If the Key Manager type displays onboard and the Restored column displays anything other than yes:
a. Enter the onboard security key-manager sync command: security key-manager onboard sync
Enter the customer’s 32 character, alphanumeric onboard key management passphrase
at the prompt. If the passphrase cannot be provided, contact NetApp Support.
mysupport.netapp.com
b. Verify the Restored column shows yes for all authentication keys: security key-manager key
query
c. Verify that the Key Manager type shows onboard, and then manually back up the OKM information.
d. Go to advanced privilege mode and enter ywhen prompted to continue: set -priv advanced
e. Enter the command to display the key management backup information: security key-manager
onboard show-backup
f. Copy the contents of the backup information to a separate file or your log file. You’ll need it in disaster
scenarios where you might need to manually recover OKM.
g. Return to admin mode: set -priv admin
h. You can safely shut down the controller.
Verify NSE configuration
1. Display the key IDs of the authentication keys that are stored on the key management servers: security
key-manager key query -key-type NSE-AK
4

After the ONTAP 9.6 release, you may have additional key manager types. The types are
KMIP, AKV, and GCP. The process for confirming these types is the same as confirming
external or onboard key manager types.
◦If the Key Manager type displays external and the Restored column displays yes, it’s safe to shut
down the impaired controller.
◦If the Key Manager type displays onboard and the Restored column displays yes, you need to
complete some additional steps.
◦If the Key Manager type displays external and the Restored column displays anything other than
yes, you need to complete some additional steps.
◦If the Key Manager type displays external and the Restored column displays anything other than
yes, you need to complete some additional steps.
2. If the Key Manager type displays onboard and the Restored column displays yes, manually back up
the OKM information:
a. Go to advanced privilege mode and enter ywhen prompted to continue: set -priv advanced
b. Enter the command to display the key management information: security key-manager onboard
show-backup
c. Copy the contents of the backup information to a separate file or your log file. You’ll need it in disaster
scenarios where you might need to manually recover OKM.
d. Return to admin mode: set -priv admin
e. You can safely shut down the controller.
3. If the Key Manager type displays external and the Restored column displays anything other than
yes:
a. Restore the external key management authentication keys to all nodes in the cluster: security key-
manager external restore
If the command fails, contact NetApp Support.
mysupport.netapp.com
b. Verify that the Restored column equals yes for all authentication keys: security key-manager
key query
c. You can safely shut down the controller.
4. If the Key Manager type displays onboard and the Restored column displays anything other than yes:
a. Enter the onboard security key-manager sync command: security key-manager onboard sync
Enter the customer’s 32 character, alphanumeric onboard key management passphrase at the prompt.
If the passphrase cannot be provided, contact NetApp Support.
mysupport.netapp.com
b. Verify the Restored column shows yes for all authentication keys: security key-manager key
query
c. Verify that the Key Manager type shows onboard, and then manually back up the OKM information.
5

d. Go to advanced privilege mode and enter ywhen prompted to continue: set -priv advanced
e. Enter the command to display the key management backup information: security key-manager
onboard show-backup
f. Copy the contents of the backup information to a separate file or your log file. You’ll need it in disaster
scenarios where you might need to manually recover OKM.
g. Return to admin mode: set -priv admin
h. You can safely shut down the controller.
Shut down the controller - ASA C250
Option 1: Most systems
After completing the NVE or NSE tasks, you need to complete the shutdown of the
impaired controller.
Steps
a. Take the impaired controller to the LOADER prompt:
If the impaired controller
displays…
Then…
The LOADER prompt Go to Remove controller module.
Waiting for giveback… Press Ctrl-C, and then respond ywhen prompted.
System prompt or password
prompt (enter system password)
Take over or halt the impaired controller from the healthy controller:
storage failover takeover -ofnode
impaired_node_name
When the impaired controller shows Waiting for giveback…, press
Ctrl-C, and then respond y.
b. From the LOADER prompt, enter: printenv to capture all boot environmental variables. Save the output
to your log file.
This command may not work if the boot device is corrupted or non-functional.
Option 2: Systems in a MetroCluster
After completing the NVE or NSE tasks, you need to complete the shutdown of the impaired controller.
Do not use this procedure if your system is in a two-node MetroCluster configuration.
To shut down the impaired controller, you must determine the status of the controller and, if necessary, take
over the controller so that the healthy controller continues to serve data from the impaired controller storage.
•If you have a cluster with more than two nodes, it must be in quorum. If the cluster is not in quorum or a
healthy controller shows false for eligibility and health, you must correct the issue before shutting down the
6

impaired controller; see Synchronize a node with the cluster.
•If you have a MetroCluster configuration, you must have confirmed that the MetroCluster Configuration
State is configured and that the nodes are in an enabled and normal state (metrocluster node show).
Steps
1. If AutoSupport is enabled, suppress automatic case creation by invoking an AutoSupport message:
system node autosupport invoke -node * -type all -message
MAINT=number_of_hours_downh
The following AutoSupport message suppresses automatic case creation for two hours: cluster1:*>
system node autosupport invoke -node * -type all -message MAINT=2h
2. Disable automatic giveback from the console of the healthy controller: storage failover modify
–node local -auto-giveback false
3. Take the impaired controller to the LOADER prompt:
If the impaired controller is
displaying…
Then…
The LOADER prompt Go to Remove controller module.
Waiting for giveback… Press Ctrl-C, and then respond ywhen prompted.
System prompt or password
prompt (enter system password)
Take over or halt the impaired controller from the healthy controller:
storage failover takeover -ofnode
impaired_node_name
When the impaired controller shows Waiting for giveback…, press
Ctrl-C, and then respond y.
Replace the boot media - ASA C250
To replace the boot media, you must remove the impaired controller module, install the
replacement boot media, and transfer the boot image to a USB flash drive.
Step 1: Remove the controller module
To access components inside the controller module, you must first remove the controller module from the
system, and then remove the cover on the controller module.
Steps
1. If you are not already grounded, properly ground yourself.
2. Unplug the controller module power supplies from the source.
3. Release the power cable retainers, and then unplug the cables from the power supplies.
4. Insert your forefinger into the latching mechanism on either side of the controller module, press the lever
with your thumb, and gently pull the controller a few inches out of the chassis.
7

If you have difficulty removing the controller module, place your index fingers through the
finger holes from the inside (by crossing your arms).
Lever
Latching mechanism
5. Using both hands, grasp the controller module sides and gently pull it out of the chassis and set it on a flat,
stable surface.
6. Turn the thumbscrew on the front of the controller module anti-clockwise and open the controller module
cover.
8

Thumbscrew
Controller module cover.
7. Lift out the air duct cover.
9

Step 2: Replace the boot media
You locate the failed boot media in the controller module by removing the air duct on the controller module
before you can replace the boot media.
You need a #1 magnetic Phillips head screwdriver to remove the screw that holds the boot media in place. Due
to the space constraints within the controller module, you should also have a magnet to transfer the screw on
to so that you do not lose it.
You can use the following video or the tabulated steps to replace the boot media:
Animation - Replace the boot media
1. Locate and replace the impaired boot media from the controller module.
10

Remove the screw securing the boot media to the motherboard in the
controller module.
Lift the boot media out of the controller module.
2. Using the #1 magnetic screwdriver, remove the screw from the impaired boot media, and set it aside safely
on the magnet.
3. Gently lift the impaired boot media directly out of the socket and set it aside.
4. Remove the replacement boot media from the antistatic shipping bag and align it into place on the
controller module.
5. Using the #1 magnetic screwdriver, insert and tighten the screw on the boot media.
Do not apply force when tightening the screw on the boot media; you might crack it.
Step 3: Transfer the boot image to the boot media
The replacement boot media that you installed is without a boot image so you need to transfer a boot image
using a USB flash drive.
•You must have a USB flash drive, formatted to MBR/FAT32, with at least 4GB capacity
•A copy of the same image version of ONTAP as what the impaired controller was running. You can
download the appropriate image from the Downloads section on the NetApp Support Site
◦If NVE is enabled, download the image with NetApp Volume Encryption, as indicated in the download
11

button.
◦If NVE is not enabled, download the image without NetApp Volume Encryption, as indicated in the
download button.
•If your system is an HA pair, you must have a network connection.
•If your system is a stand-alone system you do not need a network connection, but you must perform an
additional reboot when restoring the var file system.
1. Download and copy the appropriate service image from the NetApp Support Site to the USB flash
drive.
2. Download the service image to your work space on your laptop.
3. Unzip the service image.
If you are extracting the contents using Windows, do not use winzip to extract the
netboot image. Use another extraction tool, such as 7-Zip or WinRAR.
There are two folders in the unzipped service image file:
▪boot
▪efi
4. Copy the efi folder to the top directory on the USB flash drive.
The USB flash drive should have the efi folder and the same Service Image (BIOS) version of what the
impaired controller is running.
5. Remove the USB flash drive from your laptop.
6. If you have not already done so, install the air duct.
12

7. Close the controller module cover and tighten the thumbscrew.
13

Controller module cover
Thumbscrew
8. Align the end of the controller module with the opening in the chassis, and then gently push the
controller module halfway into the system.
9. Plug the power cable into the power supply and reinstall the power cable retainer.
10. Insert the USB flash drive into the USB slot on the controller module.
Make sure that you install the USB flash drive in the slot labeled for USB devices, and not in the USB
console port.
11. Push the controller module all the way into the chassis:
12. Place your index fingers through the finger holes from the inside of the latching mechanism.
13. Press your thumbs down on the orange tabs on top of the latching mechanism and gently push the
controller module over the stop.
14. Release your thumbs from the top of the latching mechanisms and continue pushing until the latching
mechanisms snap into place.
The controller module begins to boot as soon as it is fully seated in the chassis. Be prepared to
interrupt the boot process.
The controller module should be fully inserted and flush with the edges of the chassis.
15. Interrupt the boot process to stop at the LOADER prompt by pressing Ctrl-C when you see Starting
AUTOBOOT press Ctrl-C to abort….
If you miss this message, press Ctrl-C, select the option to boot to Maintenance mode, and then halt
the controller to boot to LOADER.
16. For systems with one controller in the chassis, reconnect the power and turn on the power supplies.
The system begins to boot and stops at the LOADER prompt.
17. Set your network connection type at the LOADER prompt:
▪If you are configuring DHCP: ifconfig e0a -auto
The target port you configure is the target port you use to communicate with the
impaired controller from the healthy controller during var file system restore with a
network connection. You can also use the e0M port in this command.
▪If you are configuring manual connections: ifconfig e0a -addr=filer_addr
-mask=netmask -gw=gateway-dns=dns_addr-domain=dns_domain
▪filer_addr is the IP address of the storage system.
▪netmask is the network mask of the management network that is connected to the HA partner.
▪gateway is the gateway for the network.
14

▪dns_addr is the IP address of a name server on your network.
▪dns_domain is the Domain Name System (DNS) domain name.
If you use this optional parameter, you do not need a fully qualified domain name in the netboot
server URL. You need only the server’s host name.
Other parameters might be necessary for your interface. You can enter help ifconfig at
the firmware prompt for details.
Boot the recovery image - ASA C250
You must boot the ONTAP image from the USB drive, restore the file system, and verify
the environmental variables.
1. From the LOADER prompt, boot the recovery image from the USB flash drive: boot_recovery
The image is downloaded from the USB flash drive.
2. When prompted, either enter the name of the image or accept the default image displayed inside the
brackets on your screen.
3. Restore the var file system:
If your system has… Then…
A network connection a. Press ywhen prompted to restore the backup configuration.
b. Set the healthy controller to advanced privilege level: set
-privilege advanced
c. Run the restore backup command: system node restore-
backup -node local -target-address
impaired_node_IP_address
d. Return the controller to admin level: set -privilege admin
e. Press ywhen prompted to use the restored configuration.
f. Press ywhen prompted to reboot the controller.
No network connection a. Press nwhen prompted to restore the backup configuration.
b. Reboot the system when prompted by the system.
c. Select the Update flash from backup config (sync flash) option
from the displayed menu.
If you are prompted to continue with the update, press y.
15

If your system has… Then…
No network connection and is in a
MetroCluster IP configuration
a. Press nwhen prompted to restore the backup configuration.
b. Reboot the system when prompted by the system.
c. Wait for the iSCSI storage connections to connect.
You can proceed after you see the following messages:
date-and-time [node-
name:iscsi.session.stateChanged:notice]:
iSCSI session state is changed to Connected
for the target iSCSI-target (type:
dr_auxiliary, address: ip-address).
date-and-time [node-
name:iscsi.session.stateChanged:notice]:
iSCSI session state is changed to Connected
for the target iSCSI-target (type:
dr_partner, address: ip-address).
date-and-time [node-
name:iscsi.session.stateChanged:notice]:
iSCSI session state is changed to Connected
for the target iSCSI-target (type:
dr_auxiliary, address: ip-address).
date-and-time [node-
name:iscsi.session.stateChanged:notice]:
iSCSI session state is changed to Connected
for the target iSCSI-target (type:
dr_partner, address: ip-address).
d. Select the Update flash from backup config (sync flash) option
from the displayed menu.
If you are prompted to continue with the update, press y.
4. Ensure that the environmental variables are set as expected:
a. Take the controller to the LOADER prompt.
b. Check the environment variable settings with the printenv command.
c. If an environment variable is not set as expected, modify it with the
setenvenvironment_variable_name changed_value command.
d. Save your changes using the saveenv command.
5. The next depends on your system configuration:
◦If your system has onboard keymanager, NSE or NVE configured, go to Restore OKM, NSE, and NVE
as needed
16

◦If your system does not have onboard keymanager, NSE or NVE configured, complete the steps in this
section.
6. From the LOADER prompt, enter the boot_ontap command.
If you see… Then…
The login prompt Go to the next Step.
Waiting for giveback… a. Log into the partner controller.
b. Confirm the target controller is ready for giveback with the
storage failover show command.
7. Connect the console cable to the partner controller.
8. Give back the controller using the storage failover giveback -fromnode local command.
9. At the cluster prompt, check the logical interfaces with the net int -is-home false command.
If any interfaces are listed as "false", revert those interfaces back to their home port using the net int
revert command.
10. Move the console cable to the repaired controller and run the version -v command to check the ONTAP
versions.
11. Restore automatic giveback if you disabled it by using the storage failover modify -node local
-auto-giveback true command.
17

You must boot the ONTAP image from the USB drive, restore the file system, and verify the
environmental variables.
1. From the LOADER prompt, boot the recovery image from the USB flash drive: boot_recovery
The image is downloaded from the USB flash drive.
2. When prompted, either enter the name of the image or accept the default image displayed inside the
brackets on your screen.
3. Restore the var file system:
If your system has… Then…
A network connection a. Press ywhen prompted to restore the backup configuration.
b. Set the healthy controller to advanced privilege level: set
-privilege advanced
c. Run the restore backup command: system node restore-
backup -node local -target-address
impaired_node_IP_address
d. Return the controller to admin level: set -privilege
admin
e. Press ywhen prompted to use the restored configuration.
f. Press ywhen prompted to reboot the controller.
No network connection a. Press nwhen prompted to restore the backup configuration.
b. Reboot the system when prompted by the system.
c. Select the Update flash from backup config (sync flash)
option from the displayed menu.
If you are prompted to continue with the update, press y.
18