AWS mgn documentation change
Summary
Updated FSx for ONTAP configuration guide with new limitations, enhanced security group requirements, detailed certificate-based authentication setup, and operational best practices.
Security assessment
The changes add significant documentation about security features including certificate-based authentication for FSx for ONTAP access, security group configurations for iSCSI and management traffic, and Autonomous Ransomware Protection (ARP) handling. However, there's no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/mgn/latest/ug/fsx-ontap.md b/mgn/latest/ug/fsx-ontap.md index 8d8f8aab4..21eebf642 100644 --- a//mgn/latest/ug/fsx-ontap.md +++ b//mgn/latest/ug/fsx-ontap.md @@ -11 +11 @@ NEW - You can now accelerate your migration and modernization with AWS Transform -# FSx for ONTAP configuration guide +# FSx for ONTAP configuration @@ -19 +19 @@ This feature is available as a **Public Preview**. -This guide provides step-by-step instructions for configuring Amazon FSx for NetApp ONTAP (FSx for ONTAP) as a migration storage target for AWS Transform MGN (MGN) when migrating to AWS. With this setup, you can use the enterprise file storage capabilities of FSx for ONTAP for your migrated workloads. This guide assumes that you are familiar with FSx for ONTAP. For detailed FSx for ONTAP setup instructions, see the [FSx for ONTAP Getting Started Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/getting-started.html). +This page provides step-by-step instructions for configuring Amazon FSx for NetApp ONTAP (FSx for ONTAP) as a storage migration target for AWS Transform MGN (MGN) when migrating to AWS. With this setup, you can use the enterprise file storage capabilities of FSx for ONTAP for your migrated workloads. This page assumes that you are familiar with FSx for ONTAP. For detailed FSx for ONTAP setup instructions, see the [FSx for ONTAP Getting Started Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/getting-started.html). @@ -21 +21 @@ This guide provides step-by-step instructions for configuring Amazon FSx for Net -FSx for ONTAP as a target storage type is available in all commercial AWS Regions where both MGN and FSx for ONTAP are available. This storage type is not available in AWS GovCloud (US) Regions, China Regions, or Local Zones. +FSx for ONTAP as a target storage type is available in all AWS Regions where both MGN and FSx for ONTAP are available. This storage type is not available in Local Zones. For supported regions, see [MGN supported regions](https://docs.aws.amazon.com/mgn/latest/ug/what-is-mgn.html#supported-regions) and [FSx for ONTAP availability by Region](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/available-aws-regions.html). @@ -23 +23 @@ FSx for ONTAP as a target storage type is available in all commercial AWS Region -When you select FSx for ONTAP as the target storage type: +### Known limitations (Public Preview) @@ -25 +25 @@ When you select FSx for ONTAP as the target storage type: - * All data volumes from a source server are stored on FSx for ONTAP. The boot volume is always stored on Amazon EBS. For more information, see [Root volumes for Amazon EC2 instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/RootDeviceStorage.html). + * **FSx for ONTAP backups can block volume cleanup**. FSx for ONTAP file systems have automatic backups enabled by default. Backups taken on target volumes can prevent MGN from deleting replication volumes on Finalize cutover/Disconnect from service migration stage. See [Troubleshooting replication volume not deleted after Finalize cutover](./fsx-ontap-troubleshooting.html#fsx-flexclone-split-blocked). @@ -27 +27,9 @@ When you select FSx for ONTAP as the target storage type: - * If you are migrating from an existing ONTAP storage system, source ONTAP configurations (such as access permissions, quotas, snapshot policies, and schedules) are not migrated automatically. You must reconfigure these settings on the target FSx for ONTAP file system after migration. + * **Multiple LUNs per volume**. MGN creates one volume per source server on the FSx for ONTAP file system and places each disk as a separate LUN within that volume. For example, a source server with 3 disks results in one volume with 3 LUNs. The ONTAP best practice is a 1:1 relationship (one volume per LUN), which allows per-volume features such as snapshots, tiering policies, and storage efficiency to be configured independently per disk. As a workaround, you can use the ONTAP [`lun move start`](https://docs.netapp.com/us-en/ontap-cli/lun-move-start.html) command to relocate LUNs into dedicated volumes after migration. This operation is non-disruptive and does not require iSCSI reconfiguration on the host. + + * **Agent-based replication only**. MGN supports FSx for ONTAP as a target storage type only with agent-based replication. + + * **Up to 5 file systems per account**. MGN supports migrating data into up to 5 FSx for ONTAP file systems concurrently per account. If you have more file systems, migrate in phases. For more information about FSx for ONTAP quotas, see [FSx for ONTAP quotas](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/limits.html). For MGN service quotas, see [MGN endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/mgn.html). + + * **ONTAP configurations not migrated**. If you are migrating from an existing ONTAP storage system, source ONTAP configurations (such as access permissions, quotas, snapshot policies, and schedules) are not migrated automatically. You must reconfigure these settings on the target FSx for ONTAP file system after migration. + + * **No mixed storage per server**. All data volumes from a source server use the same storage type (either Amazon EBS or FSx for ONTAP). You cannot mix storage types for different disks on the same server. The boot volume is always stored on Amazon EBS. @@ -40 +48 @@ Before integrating FSx for ONTAP with MGN, ensure the following: -If you initialized MGN before FSx for ONTAP support was available, you must reinitialize the service to create the required AWS managed roles (`AWSApplicationMigrationFsxProxyRole` and `AWSApplicationMigrationFsxProxyLinkRole`). In the MGN console, navigate to [Getting started](./getting-started.html) and choose **Reinitialize**. Without these roles, FSx for ONTAP target storage will not function. +If you initialized MGN before FSx for ONTAP support was available, you must reinitialize the service to create the required AWS managed roles. In the MGN console, navigate to **Settings → Replication template** and choose **Reinitialize Service Permissions**. For details on these roles and their managed policies, see [AWS Transform MGN managed policies](./security-iam-awsmanpol.html). @@ -42 +50 @@ If you initialized MGN before FSx for ONTAP support was available, you must rein - * **VPC Configuration** : FSx for ONTAP and MGN instances must be in the same AWS account and Region. They can use the same VPC or different VPCs with proper network connectivity (VPC peering, Transit Gateway, or other connectivity methods). IPv4 connectivity is required. As a best practice, deploy FSx for ONTAP and the target EC2 instances in the same Availability Zone to minimize latency and avoid cross-AZ data transfer costs. + * **VPC Configuration** : FSx for ONTAP and MGN instances must be in the same AWS account and Region. They can use the same VPC or different VPCs in which both the source and target are routable. IPv4 connectivity is required. As a best practice, use a Multi-AZ FSx for ONTAP file system when your applications require resiliency across Availability Zones. Deploy your target EC2 instances in the same AZ as the file system's preferred file server to minimize latency. If your applications do not require cross-AZ resiliency, you can use a Single-AZ FSx for ONTAP file system. Deploy your target EC2 instances in the same AZ as the file system to minimize latencies and avoid cross-AZ data transfer charges. @@ -44 +52 @@ If you initialized MGN before FSx for ONTAP support was available, you must rein - * **Staging area subnet access** : The [staging area subnet](./preparing-environments.html#Staging-Area) must have outbound access to OS package repositories (for example, through a NAT gateway or internet gateway). MGN replication servers are created on demand in this subnet and require network access to install iSCSI and multipath packages. + * **OS package repository access** : Replication servers and launched instances require iSCSI initiator and multipath tools to connect to FSx for ONTAP. Ensure that both the staging area subnet (for replication servers) and the launch subnet (for test and cutover instances) have outbound access to OS package repositories (for example, through a NAT gateway or internet gateway). @@ -46,3 +54 @@ If you initialized MGN before FSx for ONTAP support was available, you must rein - * **iSCSI and multipath packages** : MGN requires iSCSI initiator and multipath tools on the target instance to connect to FSx for ONTAP. MGN attempts to install these packages automatically during launch using the OS package manager. If the target instance does not have network access to OS package repositories (for example, in air-gapped environments or private subnets without a NAT gateway), or if the operating system uses subscription-based repositories (SUSE, RHEL, CentOS), **you must pre-install the packages on the source server before migration**. For the required packages by operating system, see Step 6: Configure launch template and launch settings and the [Supported Linux operating systems](./Supported-Operating-Systems.html#Supported-Operating-Systems-Linux) table. - - * **iSCSI and multipath packages for subscription-based operating systems** : For SUSE (SLES), RHEL, and CentOS source servers, you must pre-install iSCSI and multipath packages on the source server before migration. These operating systems use subscription credentials tied to the source instance that are not valid on the migrated target. See the prerequisites in the [Supported Linux operating systems](./Supported-Operating-Systems.html#Supported-Operating-Systems-Linux) table for the specific commands. +If the target instance does not have network access to OS package repositories (for example, in air-gapped environments or private subnets without a NAT gateway), or if the operating system uses subscription-based repositories (SUSE, RHEL, CentOS), **you must pre-install the packages on the source server before migration**. For the required packages by operating system, see Step 6: Configure launch template and launch settings and the [Supported Linux operating systems](./Supported-Operating-Systems.html#Supported-Operating-Systems-Linux) table. @@ -57 +63 @@ To enable MGN to work with FSx for ONTAP, you must create two security groups th - * **MGN-Instances-SG** – Attached to the EC2 instances that MGN launches (test and cutover). Allows outbound traffic to the FSx for ONTAP file system on iSCSI (port 3260) and HTTPS (port 443). + * **MGN-Instances-SG**. Attached to the EC2 instances that MGN launches (test and cutover). @@ -59 +65 @@ To enable MGN to work with FSx for ONTAP, you must create two security groups th - * **FSx-ONTAP-SG** – Attached to the FSx for ONTAP file system. Controls three types of inbound traffic: (1) iSCSI (port 3260) from `MGN-Instances-SG` for migration data, (2) optional SSH (port 22) and HTTPS (port 443) from `MGN-Instances-SG` for management access, and (3) HTTPS (port 443) from the FSx for ONTAP preferred and standby subnet CIDRs, required for MGN to access the ONTAP REST API during replication and launch. + * **FSx-ONTAP-SG**. Attached to the FSx for ONTAP file system. Controls inbound traffic from MGN-launched instances. @@ -72 +78 @@ Create this security group in the VPC where MGN will launch target instances. -If you use different VPCs for replication and launch, create two security groups with distinct names for clarity. For example, use `MGN-Replication-SG` (in the staging VPC) and `MGN-Launch-SG` (in the launch VPC). The rules for both are identical. +If you use different VPCs for replication and launch, create two security groups with distinct names for clarity. For example, use `MGN-Replication-SG` (in the staging VPC) and `MGN-Launch-SG` (in the launch VPC). @@ -86 +92 @@ If you use different VPCs for replication and launch, create two security groups - 3. **Inbound Rules:** Add any inbound rules as needed based on your application requirements (for example, RDP or SSH for management access). Replace `Your admin CIDR` with the IP address range from which your administrators connect (for example, your corporate VPN range or bastion host subnet CIDR). + 3. **Inbound Rules:** The only required inbound rule is port 1500 for MGN data replication from source servers. You can optionally add rules for administrative access to your instances (for example, SSH on port 22 or RDP on port 3389 from your corporate network). @@ -90,2 +95,0 @@ Type | Protocol | Port Range | Source | Description -SSH | TCP | 22 | `Your admin CIDR` | Management access (Linux) -RDP | TCP | 3389 | `Your admin CIDR` | Management access (Windows) @@ -124 +128 @@ You associate this security group with the FSx for ONTAP file system. Use this s - * **Migration traffic (iSCSI)** – Required for MGN data replication and launch. Reference `MGN-Instances-SG` as the source. + * **Migration traffic (iSCSI)**. Required for MGN data replication and launch. Reference `MGN-Instances-SG` as the source. @@ -126 +130 @@ You associate this security group with the FSx for ONTAP file system. Use this s - * **Management access (SSH, HTTPS)** – Optional rules for ONTAP CLI and REST API access from MGN-launched instances (for example, for troubleshooting or manual configuration). Reference `MGN-Instances-SG` as the source. + * **Management access (SSH, HTTPS)**. Optional rules for ONTAP CLI and REST API access from MGN-launched instances (for example, for troubleshooting or manual configuration). Reference `MGN-Instances-SG` as the source. @@ -128 +132 @@ You associate this security group with the FSx for ONTAP file system. Use this s - * **MGN service traffic (HTTPS)** – Required for MGN to access the FSx for ONTAP REST API during replication and launch. Use the CIDR blocks of the preferred and standby subnets where the file system is deployed. You can find these CIDRs in the **FSx for ONTAP Console** under your file system's **Network & security** tab, or in the **VPC Console → Subnets** by looking up the subnet IDs. + * **MGN service traffic (HTTPS)**. Required for MGN to access the FSx for ONTAP REST API during replication and launch. Use the CIDR blocks of the preferred and standby subnets where the file system is deployed. You can find these CIDRs in the **FSx for ONTAP Console** under your file system's **Network & security** tab, or in the **VPC Console → Subnets** by looking up the subnet IDs. You can narrow this scope after the initial setup is complete. @@ -150 +154 @@ HTTPS | TCP | 443 | `FSx standby subnet CIDR` | MGN access to ONTAP REST API -If you do not already have an FSx for ONTAP file system, create one in the same AWS account and Region where MGN will launch target instances. Up to 5 FSx for ONTAP file systems are supported per account, each source server supports up to 63 data volumes, and MGN supports up to 10 snapshots per ONTAP volume. +MGN can work with an existing FSx for ONTAP file system or a new one. If you do not already have an FSx for ONTAP file system, create one in the same AWS account and Region where MGN will launch target instances. @@ -158 +162 @@ If you do not already have an FSx for ONTAP file system, create one in the same - 3. Choose deployment type (Multi-AZ for production, Single-AZ for testing). + 3. Choose deployment type (Multi-AZ or Single-AZ). @@ -177 +181 @@ If you do not already have an FSx for ONTAP file system, create one in the same - * **For Multi-AZ deployments** : you must specify an Endpoint IPv4 or IPv6 address range (not unallocated or floating). Use the "Enter an IPv4/IPv6 address range" option and provide a specific range (for example, `192.168.1.0/24`). This is required for MGN integration to ensure consistent endpoint addressing. + * **For Multi-AZ deployments** : you must specify an Endpoint IPv4 address range (not unallocated or floating) that is outside your VPC CIDR. Use the "Enter an IPv4 address range" option and provide a specific range within RFC 1918 private address space (for example, `192.168.1.0/24`). This is required for MGN integration to ensure consistent endpoint addressing. @@ -179 +183 @@ If you do not already have an FSx for ONTAP file system, create one in the same - * **Storage capacity** : MGN uses FSx for ONTAP storage for replication, conversion, and cutover. These processes require temporary storage on the file system. Ensure that sufficient space is available on the FSx for ONTAP file system and increase capacity if needed. As a guideline, provision 3x the size of the planned migration data. The 3x factor accounts for three concurrent storage consumers during migration: the replicated data, the converted volumes used for launch, and the original volumes pending deletion. Volume deletion in FSx for ONTAP is a background operation — freed capacity is not available immediately after deletion, so headroom must be provisioned upfront. As a best practice, keep the file system at or below 80% SSD capacity utilization. You can decrease storage capacity after migration is complete. For more information, see [Managing storage capacity and provisioned IOPS](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/storage-capacity-and-IOPS.html). + * **Storage capacity** : MGN uses FSx for ONTAP storage for replication, conversion, and cutover. These processes require temporary storage on the file system. Ensure that sufficient space is available on the FSx for ONTAP file system and increase capacity if needed. As a guideline, provision 3x the size of the planned migration data. The 3x factor accounts for three concurrent storage consumers during migration: the replicated data, the converted volumes used for launch, and the original volumes pending deletion. Volume deletion in FSx for ONTAP is a background operation — freed capacity is not available immediately after deletion, so headroom must be provisioned upfront. As a best practice, keep the file system at or below 80% SSD capacity utilization throughout the migration. For second-generation file systems ([Single-AZ 2 and Multi-AZ 2](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/high-availability-AZ.html) deployment types), you can decrease storage capacity after migration is complete. For more information, see [Managing storage capacity and provisioned IOPS](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/storage-capacity-and-IOPS.html). @@ -181 +185 @@ If you do not already have an FSx for ONTAP file system, create one in the same - * **Throughput capacity** : Higher throughput capacity reduces migration time. Throughput is selected from fixed tiers (for example, 256, 512, 1024, 2048, or 4096 MBps for Gen 1 file systems) and is a billable dimension — higher tiers increase cost. To size throughput for migration, sum the average read throughput and write throughput across all source servers being migrated to the file system, add 15% headroom, and round up to the next available tier. Plan your throughput tier before starting migration, as changes take time to take effect. You can reduce throughput after migration is complete. For more information, see [Managing throughput capacity](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-throughput-capacity.html) and [FSx for ONTAP performance](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/performance.html). + * **Throughput capacity** : Higher throughput capacity reduces migration time. Throughput is selected from supported values and is a billable dimension. To size throughput for migration, sum the average read throughput and write throughput across all source servers being migrated to the file system, add 15% headroom, and round up to the next supported value. Plan your throughput capacity before starting migration, as changes take time to take effect. You can reduce throughput after migration is complete. For more information, see [Managing throughput capacity](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-throughput-capacity.html) and [FSx for ONTAP performance](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/performance.html). @@ -186 +190 @@ If you do not already have an FSx for ONTAP file system, create one in the same -###### Disable Anti-Ransomware Protection (ARP) +###### Disable Autonomous Ransomware Protection (ARP) @@ -188 +192 @@ If you do not already have an FSx for ONTAP file system, create one in the same -If ONTAP ARP is enabled on the file system, disable it before migration. ARP can affect the split clone flow and MGN migration completion. For more information, see [Enabling Anti-Ransomware Protection](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/enable-ARP.html). +If ONTAP ARP is enabled on the file system, disable it before migration. ARP can prevent MGN from deleting replication volumes on Finalize cutover/Disconnect from service migration stage. For more information, see [Enabling Autonomous Ransomware Protection](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/enable-ARP.html). @@ -198 +202 @@ For detailed instructions on creating and configuring FSx for ONTAP file systems -CHAP authentication for iSCSI targets is not supported. You must use certificate-based authentication as described in this section. +MGN does not use CHAP for iSCSI. iSCSI access is controlled via security groups, and MGN authenticates to the ONTAP management API using client certificates as described in this section. @@ -206,2 +210,2 @@ Certificate options Option | Use Case | Documentation -**Self-Signed Certificate** | Testing/Development | [Generate Self-Signed Certificate with OpenSSL](https://www.openssl.org/docs/man1.1.1/man1/req.html) -**ACM Private CA** | Production (Recommended) | [Request a Private Certificate](https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request-private.html) +**Self-Signed Certificate** | Testing/Development | [Generating a self-signed certificate for FSx for ONTAP](./fsx-ontap-generate-certs.html) +**AWS Private Certificate Authority** | Production (Recommended) | [AWS Private Certificate Authority](https://docs.aws.amazon.com/privateca/latest/userguide/PcaWelcome.html) @@ -210,81 +214 @@ Certificate options Option | Use Case | Documentation -**Quick Start - Self-Signed Certificate:** - -For testing, create a self-signed certificate: - - 1. Download the FSx for ONTAP certificate bundle (change the region in the URL): - - curl https://fsx-aws-certificates.s3.amazonaws.com/bundle-region.pem \ - -o bundle-region.pem - -See [Managing resources using ONTAP applications](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-resources-ontap-apps.html) for details. - - 2. Create a Certification Authority (CA): - - # Generate CA private key - openssl genrsa -out ca.key 4096 - - # Create self-signed CA certificate - openssl req -new -x509 -key ca.key -out ca.crt -days 3650 \ - -subj "/CN=FSx-ONTAP-Client-CA/O=YourOrg/C=US" \ - -addext basicConstraints=critical,CA:TRUE \ - -addext keyUsage=critical,keyCertSign,cRLSign \ - -addext subjectKeyIdentifier=hash - - 3. Generate a client key: - - openssl genrsa -out fsx-mgn-client.key 2048 - - 4. Create an `openssl-client.cnf` file: - - [ req ] - default_bits = 2048 - prompt = no - default_md = sha256 - distinguished_name = dn - req_extensions = req_ext - - [ dn ] - CN = cert_usr - O = YourOrg - C = US - - [ req_ext ] - keyUsage = critical, digitalSignature, keyEncipherment - extendedKeyUsage = clientAuth - subjectKeyIdentifier = hash - - [ usr_cert ] - keyUsage = critical, digitalSignature, keyEncipherment - extendedKeyUsage = clientAuth - authorityKeyIdentifier = keyid,issuer - subjectKeyIdentifier = hash - - 5. Create a new certificate signing request (CSR): - - openssl req -new -key fsx-mgn-client.key -out fsx-mgn-client.csr \ - -config openssl-client.cnf - - 6. Sign the CSR with your CA: - - openssl x509 -req -in fsx-mgn-client.csr \ - -CA ca.crt -CAkey ca.key -CAcreateserial \ - -out fsx-mgn-client.crt -days 365 \ - -extfile openssl-client.cnf -extensions usr_cert - - 7. Verify the certificate: - - openssl verify -CAfile ca.crt fsx-mgn-client.crt - - - - -**For Production:** Follow the [ACM Private CA documentation](https://docs.aws.amazon.com/privateca/latest/userguide/PcaWelcome.html) to request and export a certificate with private key. - -**Required output files:** - - * `fsx-mgn-client.crt` – Client certificate - - * `fsx-mgn-client.key` – Private key (PKCS#8 format) - - - +###### Note @@ -295 +219 @@ The private key must be in PKCS#8 format (`-----BEGIN PRIVATE KEY-----`). If you - openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt \ + [~]$ openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt \ @@ -300 +224,3 @@ The private key must be in PKCS#8 format (`-----BEGIN PRIVATE KEY-----`). If you -Install the client certificate on the FSx for ONTAP to enable certificate-based authentication. For more information, see [Installing certificates on ONTAP](https://docs.netapp.com/us-en/ontap/authentication/install-server-certificate-cluster-svm-ssl-server-task.html). +Install the client certificate on the FSx for ONTAP to enable certificate-based authentication. In the following commands, replace `vserver_name` with your file system ID (e.g., `FsxId08f0e724d292c729c`). You can find this in the FSx for ONTAP console under your file system's details. + + 1. Connect to the file system's management endpoint. Log in to an EC2 instance in the same VPC as the FSx for ONTAP file system, then use the `fsxadmin` user to SSH into the file system's management endpoint IP address or DNS name: @@ -302 +228 @@ Install the client certificate on the FSx for ONTAP to enable certificate-based - 1. Connect to the FSx for ONTAP file system's management endpoint with SSH (requires an EC2 instance that can SSH into FSx for ONTAP): + [~]$ ssh fsxadmin@file-system-management-endpoint-ip-address @@ -304 +230 @@ Install the client certificate on the FSx for ONTAP to enable certificate-based - ssh fsxadmin@file-system-management-endpoint-ip-address +For more information, see [Managing file systems with the ONTAP CLI](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-resources-ontap-apps.html#fsxadmin-ontap-cli). @@ -308,2 +234,2 @@ Install the client certificate on the FSx for ONTAP to enable certificate-based - security certificate install -type client-ca \ - -vserver FsxIdYOUR_FS_ID -cert-name my-client-ca + FsxId0123456::> security certificate install -type client-ca \ + -vserver vserver_name -cert-name my-client-ca @@ -314 +240 @@ Install the client certificate on the FSx for ONTAP to enable certificate-based