Reference Guide
Table Of Contents
- Dell EMC PowerStore Security Configuration Guide
- Contents
- Additional Resources
- Authentication and access
- Hardware root of trust
- Authenticating and Managing User Accounts, Roles, and Privileges
- Certificates
- Secure communication between PowerStore appliances within a cluster
- Secure communication for replication and data import
- vSphere Storage API for Storage Awareness support
- CHAP authentication
- Configuring CHAP
- External SSH access
- Configuring external SSH access
- NFS secure
- Security on file system objects
- File systems access in a multiprotocol environment
- Understanding Common AntiVirus Agent (CAVA)
- Code signing
- Communication security settings
- Auditing
- Data security settings
- Secure serviceability settings
- Operational description of SupportAssist
- SupportAssist options
- SupportAssist Connect via Gateway option
- SupportAssist Connect Directly option
- Requirements for SupportAssist Connect via Gateway
- Requirements for SupportAssist Connect Directly
- Configuring SupportAssist
- Configure SupportAssist
- CloudIQ
- Cybersecurity
- Security Alert Settings
- TLS cipher suites
- Directory Services
● Connect Directly — For distributed SupportAssist that runs on individual appliances with the same two-way file transfer as
connecting through a SupportAssist gateway server.
Another option, Disabled, is available but not recommended. If you select this option, Dell EMC Support will not receive
notifications about issues with the appliance. You may need to collect appliance information manually to assist support
representatives with troubleshooting and resolving problems with the appliance.
SupportAssist Connect via Gateway option
When you select the Connect via Gateway option, your appliance is added to other appliances in a SupportAssist cluster. The
cluster resides behind a single common (centralized) secure connection between Dell EMC Support servers and an off-array
gateway server. The gateway server is the single point of entry and exit for all IP-based Dell EMC SupportAssist activities for
the appliances associated with the gateway.
The gateway server is a remote support solution application that is installed on one or more customer-supplied dedicated
servers. The Connect via Gateway option supports up to two gateway servers, one as primary and one as a backup. The
gateway server functions as a communication broker between the associated appliances and the Dell EMC enterprise.
To configure your appliance to use the Connect via Gateway option for SupportAssist, you need to provide the IP address and
port number (9443 is the default) for each gateway server. Also, ensure that the port is open between the gateway server and
the appliance.
NOTE: The gateway server must be up and running before you configure your appliance to use it. Appliances can only be
added to the gateway from the PowerStore Manager. If the appliance is added from the gateway server, it will appear to be
connected, but will not successfully send system information.
For more information about the SupportAssist Gateway, access the SupportAssist product page on the Dell Support website
(https://www.dell.com/support).
SupportAssist Connect Directly option
For the Connect Directly option, SupportAssist runs directly on the primary node of each appliance. In a cluster, each
appliance establishes its own connection to Dell EMC Support. Traffic is not routed through the primary appliance in a cluster.
However, SupportAssist can only be managed at the cluster level, that is, all changes are applied to every appliance in the
cluster.
Enable and configure the Connect Directly option from the Support Assist page, which can be accessed through Settings
and is listed under Support in the PowerStore Manager. These actions set up the appliance to use a secure connection
between itself and Dell EMC Support.
When you select the Connect Directly option and accept the End User License Agreement (EULA), the appliance sets up a
secure connection between itself and Dell EMC Support. This option enables remote access service connectivity capability with
the appliance to and from Dell EMC Support along with two-way file transfer. If applicable, you can configure the connection
from the appliance to an associated proxy server (optional).
When a new appliance is added to an existing cluster, the new appliance will detect the cluster SupportAssist settings and
automatically configure the new appliance to match. If the Connect Directly option is currently enabled, it will be automatically
enabled on the new appliance. Additional actions are not necessary. If Connect Directly option cannot be enabled, it will not
prevent the add-appliance process from completing.
Requirements for SupportAssist Connect via Gateway
The following requirements are applicable to the Connect via Gateway SupportAssist implementation:
● Network traffic (HTTPS) must be permitted on port 9443 (or customer specified port, if different) between the appliance
and the SupportAssist Gateway server. Also, allow access to ports 22, 443, and 8443 between PowerStore and the
SupportAssist Gateway server for PowerStore Manager and SSH accessing.
● The SupportAssist Gateway server must be version 4.0.5.3 or version 3.38 and above.
● Ensure that the PowerStore cluster is running PowerStore OS version 1.0.1.0.5.002 or higher.
NOTE:
Never manually add or remove an appliance from the gateway server. Only add or remove an appliance from the
PowerStore Manager SupportAssist configuration wizard.
Secure serviceability settings 45