AWS fsx documentation change
Summary
Added details about specifying custom IP address ranges for Multi-AZ file system endpoints, including console vs CLI/API defaults and custom range recommendations
Security assessment
Changes focus on IP address range configuration options and failover mechanics without mentioning security vulnerabilities or introducing new security features. The updates provide operational guidance rather than addressing security concerns.
Diff
diff --git a/fsx/latest/ONTAPGuide/supported-fsx-clients.md index 3ea4acdd2..e71888e8e 100644 --- a/fsx/latest/ONTAPGuide/supported-fsx-clients.md +++ b/fsx/latest/ONTAPGuide/supported-fsx-clients.md @@ -142,0 +143,2 @@ These floating IP addresses are created in the VPC route tables that you associa + * You can also specify your own IP address range when you use the **Standard create** option. The IP address range that you choose can either be inside or outside the VPC’s IP address range, as long as it doesn't overlap with any subnet, and as long as it isn't already used by another file system with the same VPC and route tables. For this option we recommend using a range that is inside the VPC's IP address range. + @@ -203 +205,12 @@ Amazon FSx requires that you use AWS Transit Gateway or that you configure remot -Because the NFS, SMB, and management endpoints use floating IP addresses, you must use [AWS Transit Gateway](https://aws.amazon.com/transit-gateway/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) in conjunction with AWS Direct Connect or AWS VPN to access these interfaces from an on-premises network. The floating IP addresses used for these interfaces are within the `EndpointIpAddressRange` you specify when creating your Multi-AZ file system. If you create your file system from the Amazon FSx console, by default Amazon FSx chooses the last 64 IP addresses from the VPC's primary CIDR range to be used as the endpoint IP address range for the file system. If you create your file system from the AWS CLI or the API, by default Amazon FSx chooses an IP address range from within the `198.19.0.0/16` IP address range. The floating IP addresses are used to enable a seamless transition of your clients to the standby file system in the event a failover is required. For more information, see [Failover process for FSx for ONTAP](./high-availability-AZ.html#Failover). +Because the NFS, SMB, and management endpoints use floating IP addresses, you must use [AWS Transit Gateway](https://aws.amazon.com/transit-gateway/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) in conjunction with AWS Direct Connect or AWS VPN to access these interfaces from an on-premises network. The floating IP addresses used for these interfaces are within the `EndpointIpAddressRange` you specify when creating your Multi-AZ file system. The `EndpointIpAddressRange` uses the following address ranges, depending on how a file system is created: + + * Multi-AZ file systems created using the Amazon FSx console use the last 64 IP addresses in the VPC's primary CIDR range for the file system's `EndpointIpAddressRange` by default. + + * Multi-AZ file systems created using the AWS CLI or Amazon FSx API use an IP address range within the `198.19.0.0/16` address block for the `EndpointIpAddressRange` by default. + + * You can also specify your own IP address range when you use the **Standard create** option in the Amazon FSx console The IP address range that you choose can either be inside or outside the VPC’s IP address range, as long as it doesn't overlap with any subnet, and as long as it isn't already used by another file system with the same VPC and route tables. For this option we recommend using a range that is inside the VPC's IP address range. + + + + +The floating IP addresses are used to enable a seamless transition of your clients to the standby file system in the event a failover is required. For more information, see [Failover process for FSx for ONTAP](./high-availability-AZ.html#Failover).