Ask the Expert: EMC Secure Remote Services (ESRS) – New Release, New Name, New Virtual Edition

Well ..in the South East region we like to call James, Mr ESRS

Hello,

Has ESRS v3.02 virtual edition been released  ?

Regards,

Pawan

Thank you Josh.

That's Helpful !!

Regards,

Pawan

Hi Team,

my customer is very interested to get more Information on the build-in certificates itself.

Can we provide some details on the certifications?

Do we have special approvals for ESRS v3 from official security authorites like Dept of Defense?

Thanks,

Udo

Hi Udo,  thanks for the question -

ESRS uses advanced security features to ensure a secure connection between the customer site and EMC.  There are 5 key features of this secured connection;

1. RSA Certificates (2048 bit)

2. Transport Security Layer (TLS) using a cipher of AES - 256

3. Federal Information Processing Standard (FIPS) 140-2

4. Outward bound only connections

5. Customer controlled policies

Hope this answers your question.  There is much more detail contained in the ESRS Guides.

Regards,

Dan

Thank you very much, Dan.

It does help in the first step.

Btw - great initiative with "ask the expert".

Regards,

Udo

Thanks David.

Roberto, I wasn't sure how you guys wanted to handle the ask the expert but I do have a question from my customer. 

- I have a ESRS customer that wants to change the passwords for the local accounts "OnAlert" and "ESRSConfig" that were created with the product was installed.

What would we need to altered/ fixed / /changed after changing those passwords in those 2 accounts noted above. 

Thanks guys!! 

Rocky Tutor

Advisory SE

919-302-8485

The user ESRSConfig is not important so no changes would need to be made if the password was changed.  If the password for OnAlert was changed and if the customer uses FTP in their environment and if they have any arrays which use FTP connect home, then those arrays would have to be reconfigured for connect home to use the new password.

The esrsconfig account is only used under special circumstances, and then only normally when installing ESRS, so there is probably no need for this account any more.

The onalert account is used by every EMC device at the customer's site which call-home via the ESRS gateways AND uses the FTP protocol to do this. So if the onalert account password is changed on the ESRS gateway, somebody has to connect to each device and reconfigure the call-home setup, specifying a non-default password for "onalert". This is normally carried out by EMC CS, and can usually be done remotely via ESRS.

It is mainly Symmetrix/VMAX and VNX unified devices which can use FTP.

On a Symm/VMAX call-home is setup using teh ConnectEMC GUI on the Service Processor. For the VNX, it can be done via the Unisphere GUI, or command-line.

I have a question: Can ESRS Device Client for VNX handle ACU(Automatic Capture Upload)?

Answer is yes. ESRS Device Client for VNX do handle ACU which is now on the SP. The latest Release Notes for VNX1 - 05.32.000.5.215 and VNX2 - 05.33.000.5.074 do mentioned the below.

This release also introduces a means to control when your VNX for Block system configuration data is captured, which is subsequently sent through ConnectEMC to your service provider. You can manage the settings for the capture of the VNX for Block system configuration data through System > Capture Configuration Data (from the task list under Service Tasks).

I just read the release notes for OE for Block patch 74 (VNX2) and I stumbled on this new ESRS. The thing we are concerned about is security. We are ISO "security" certified (don't remember which number that is) and we have to make absolutely sure that nobody (EMC) is able to "hop" from the EMC endpoint (the faulty VNX for example) to another node in that subnet, or worse: on another subnet.

As soon as we have a dedicated "EMC subnet" we will definitely investigate ESRS and probably implement. Finally

Hello all,

I'm new to ESRS, but I wanted to make sure that this can be also configured for EMC software based products, such as NetWorker and DPA for example?

Thank you,

Carlos