PowerVault ME5, ME52: How to Configure SupportAssist to Connect Using Gateway Server

• About using SupportAssist
• SupportAssist Configuration Pre-requisites
• Configuring the PowerVault ME series with SCG Virtual Edition (VE)
  • How does SCG VE discover the PowerVault ME5
  • Using PowerVault Manager to Connect using Gateway Server
  • Using Command-Line Interface (CLI) to add the gateway server
• Information about Secure Connect Gateway (SCG)
  • Pre-requisites for PowerVault ME5 SupportAssist using SCG
• Viewing PowerVault ME series as a device in SCG VE
• Troubleshooting tips and hints

About using SupportAssist
Dell Technologies recommends enabling SupportAssist on the PowerVault ME5 series. SupportAssist can help reduce time taken to resolve technical support queries and when used with APEX AIOps infrastructure observability (formerly CloudIQ) can provide you with insight into array system health, capacity consumption, and performance anywhere in the world using an Internet browser or CloudIQ smartphone app.

• Automatic case creation (for example, disk drive failure) with Dell Technical Support for in warranty products
• Receive notification of available controller or disk drive firmware updates in PowerVault Manager.
• Use Dells APEX AIOps Infrastructure observability service (formerly CloudIQ) to remotely monitor your arrays heath using Internet browser or CloudIQ smartphone application. For more information, see APEX AIOps Observability: General Procedures to Onboard PowerVault ME Series Arrays.
• Simple for operators to send telemetry data from the product to Dell technical support. See section on SupportAssist in PowerVault ME5: How to collect PowerVault support logs

Figure 1: SupportAssist connection image
 

The following pre-requisites must be met to configure SupportAssist connection using Secure Connect Gateway.

• SupportAssist can be enabled to send telemetry data using Dell Secure Connect Gateway (SCG VE) appliance or alternatively a direct connection to Dell endpoints.
• To configure SupportAssist using a direct connection, see this article: PowerVault ME5: How to enable SupportAssist using direct connection

Outline of steps required to configure SupportAssist to connect to SCG VE.

1. SCG VE appliance deployed in your organization must be able to connect to Dell endpoints. 
2. PowerVault ME5 administrators must configure the array to use a Domain Name System (DNS) server that can resolve endpoint hostnames.
3. Configure PowerVault ME5 SupportAssist to connect to the SCG VE appliance on port 9443. Example: https://SCG.VE.Management.Address:9443
4. Where applicable, that is on systems shipped from Dell prior to April 2023, enter Access key & PIN (AK&P). Systems shipped since this date do not require this step.

Information about Secure Connect Gateway (SCG)
SCG is available as two separate applications:  PowerVault ME5 users must use Secure Connect Gateway - Virtual Edition, or Secure Connect Gateway. 

• SCG Application Edition (SCG AE) installs on Microsoft Windows. This replaces SupportAssist enterprise (SAE) application version and is used in environments without a hypervisor. This version can be used to monitor Dell PowerEdge servers, Dell switches, and previous generation Dell Storage products such as EqualLogic/PS Series, Compellent/SC Series, PowerVault MD3xxx, and PowerVault ME4 series.

• SCG Virtual Edition (SCG VE) is a Linux appliance installed in a hypervisor environment such as Broadcom ESXi or Microsoft Hyper-V. This appliance is also available for Docker, Podman, or Kubernetes environments. Supported hypervisors are listed in the SCG VE support matrix accompanying the software version. SCG VE is needed if you want to discover ALL supported devices from the Dell Enterprise product range. SCG VE V5.10.x and later add support for PowerVault ME5 series as an endpoint for SupportAssist. 
• SCG VE Deployment and configuration guides are available online and a YouTube playlist with a series of short videos with guides to use SCG VE are available.
• System administrators can review the Security for Secure Connect Gateway whitepaper.
• SCG VE appliance must be able to connect to the Dell secure remote server endpoint before you configure PowerVault ME5 SupportAssist to connect using Gateway server appliance. Within the SCG VE application, click Connectivity in the header and then click Network connections and services. You can click Test connection to verify connectivity to the Global access and Enterprise servers. If SCG VE is not operational, see the Secure Connect Gateway Virtual Edition Troubleshooting Guide.

Configuration pre-requisites for PowerVault ME5 SupportAssist configuration using a Secure Connect Gateway endpoint.

• Secure Connect Gateway Virtual edition (SCG VE) V5.10.x and later configured and connecting to Dell endpoint.
• PowerVault ME5 must be able to resolve domain names. Ensure that each controller is configured in PowerVault Manager to use a DNS server. See section Configuring PowerVault ME5 to Connect using Gateway Server. 
• On systems shipped prior to April 2023, an Access key and PIN is required to activate SupportAssist on PowerVault ME5. For details see ME5: How to generate an Access Key and Pin to enable SupportAssist. If you need assistance generating AK&P contact Dell Technical Support.
• The management network must be configured on PowerVault ME5 controllers. The management network IP on Controller A must be able to reach the SCG VE appliance. SupportAssist service defaults to Controller A. The service runs on Controller B when A is offline. 
• PowerVault ME5 SAN SupportAssist uses TCP port 9443 https://SCG.VE.Management.Address:9443 to establish a connection with the SCG VE gateway appliance.
   
  Note: Attempting to configure SupportAssist to connect to SCG management port 5700 does NOT work.
   

Configuring PowerVault ME5 series with SCG VE

How does SCG VE discover the PowerVault ME5?
In the SCG VE support matrix, supported devices are listed along with two discovery methods. Depending on the device, there are two possible methods:

• Configure SupportAssist on the device to connect to the Secure Connect Gateway appliance. This method applies to the PowerVault ME5 series. SupportAssist establishes a secure mutual connection with the SCG VE appliance.
• Add a device manually using the Secure Connect Gateway user interface. This method only applies to the PowerVault ME4 series.

Administrators must follow the instructions further down to configure SupportAssist to Connect using Gateway Server.

Figure 2: Attempting to manually add a PowerVault ME5 in SCG VE fails.
 

Configuring PowerVault ME5 to Connect using Gateway Server using PowerVault Manager.
Configure both controllers to resolve DNS names using PowerVault Manager.

• In the PowerVault manager, the Network panel (Settings > Network) provides options for you to configure network-port settings, including a specifying DNS server.
• Configure both controller modules to resolve DNS (Settings > Network > DNS).

Change the SupportAssist connection type to Gateway Server using PowerVault Manager.
Use the Support panel (Maintenance > Support) to configure SupportAssist.

1. Select the SupportAssist tab
2. Check the box Connect to SupportAssist and Connect to APEX AIOps (ME5.1.2.1.x and later) or Connect to CloudIQ (ME5.1.2.0.3 and earlier). You can sign on to the APEX AIOps (formerly CloudIQ) service later. For more information, see Article: APEX AIOps Observability: General Procedures to Onboard PowerVault ME Series Arrays
3. The SupportAssist agreement is displayed. Read through the agreement, then acknowledge it by selecting I accept this agreement and clicking ACCEPT AND CONTINUE.
4. In the Connection Information panel, select your connectivity options:

• Connection Type - Select whether to Connect Directly or Connect using Gateway Server

• Proxy Details - If applicable, select Use a Proxy Server and then enter the server settings.
• Access key and PIN - This is not presented on systems shipped after April 2023. If asked enter the information requested. If you do not have the access key or PIN, click request a new Access Key and PIN and follow the prompts to have new key information emailed to you. For more information, see PowerVault ME5: How to Generate an Access Key and Pin to Enable SupportAssist
• Click Test and Enable Connectivity - Test results are displayed, you can either go back and reenter information, or click Continue to proceed.

5. In the Contact Information panel, enter the primary contact information and select the preferred contact settings. You can also enter information for a secondary contact
6. Click Apply changes, and click OK on the confirmation prompt.

Access key and PIN to authenticate key exchange on systems shipped prior to April 2023.

• PowerVault ME5 uses a two-factor authentication Access key and PIN method to generate the keys required to establish a secure connection. Since April 2023, this is preloaded at the Dell factory and is likely not required for your system.
• Administrators must log in using a registered business account to generate an access key and PIN to activate SCG VE and SupportAssist on PowerVault ME5 series arrays.

Using Command-Line Interface (CLI) to add the gateway server on PowerVault ME5 
Using Command-Line Interface (CLI) to configure DNS settings.

• Administrators can optionally open an SSH session to either controller module using an SSH client or a terminal application such as PuTTY .
• Use the following commands to configure DNS on both controllers. Command syntax is shown by preceding the command with help. For example, help set dns-parameters
• To display DNS settings:

show dns-management-hostname
show dns-parameters

• To configure DNS settings:

set dns-management-hostname name <controllerAHostname> controller A
set dns-management-hostname name <controllerBHostname> controller B
set dns-parameters nameservers <DNS Server 1 IP>,<DNS Server 2 IP> search-domains <mydomain.local> controller A
set dns-parameters nameservers <DNS Server 1 IP>,<DNS Server 2 IP> search-domains <mydomain.local> controller B

Using Command-Line Interface (CLI) to enable SupportAssist.
Open an SSH session to either PowerVault ME5 management controller IP address. To learn the syntax options for each command, precede the command with help. For example, use help set support-assist-connection and help check support-assist-connection. The commands relevant to SupportAssist configuration are listed here.

• Commands to view SupportAssist configuration and operation.

show support-assist eula
show support-assist
show support-assist-contact
show support-assist-telemetry-status

• Commands to configure SupportAssist.

Skip commands that do not apply such as proxy configuration or access key and PIN.

set support-assist-connection connection-preference gateway gateway-urls https://<SCG.VE.Address:9443>
set support-assist-proxy
set support-assist-authentication access-key <Access Key> pin <PIN Number>
set support-assist-contact

• Test the network connection used by SupportAssist to connect to the gateway or if direct to the SCG VE endpoint or Dell endpoint.

check support-assist-connection mode gateway
check support-assist-connection mode direct

• Check if updated controller or drive firmware updates are available for the PowerVault ME5.

check support-assist-updates

Sample configuration CLI command sequence on PowerVault ME5

show support-assist eula
set support-assist enabled
set support-assist cloud-iq enabled
set support-assist-connection connection-preference gateway gateway-urls <https://<SCG.VE.Management.Address:9443>
check support-assist-connection mode gateway
/* Most systems do not require AK&P */  set support-assist-authentication access-key <Access Key> pin <PIN Number>

Continue afterwards and configure a primary and secondary IT contact for your organization using the set support-assist-contact command.

Viewing PowerVault ME series as a device in SCG VE

1. Click Device management
2. Select Devices

1. PowerVault ME4 arrays appear after they have been added. (using Add a device)
2. PowerVault ME5 arrays appear after SupportAssist has been configured in PowerVault Manager to use the Secure Gateway.

Troubleshooting tips and hints
How can the network connection to an SCG VE appliance be verified from the PowerVault ME5?

1. Open an SSH session to either PowerVault ME5 controller module A management IP address.
2. Confirm that DNS is configured using the command:

show dns-parameters

3. To verify a network connection can be formed between the ME5 and SCG VE appliance. Use the command:

check support-assist-connection mode gateway

# check support-assist-connection mode gateway uri https://x.x.x.x:9443 proxy false
SupportAssist Connection
------------------------
Connection State: Connected

  Endpoint
  --------
  Mode: gateway
  Endpoint: https://x.x.x.x:9443
  Status: success
  HTTP Status: 200
  Message: OK
  Status Detail: Success
  Proxy Type: none

Success: Command completed successfully. (2022-07-04 12:50:02)

• Message HTTP Status: 200 and Message: OK HTTP Status: 200 means that the network connection between the ME5 array and the Secure Connect Gateway is good and the web service is running on SCG VE. Message: OK means that services are running on the SCG VE appliance.
• If your organization uses firewalls between company sites, ensure TCP port 9443 is open to allow the remote ME5 to establish a secure connection with the SCG VE appliance.

Is telemetry data from PowerVault ME5 being sent to Dell?

1. Click Audit > File Transfer
2. Filter by the PowerVault ME5 service tag.
3. If Enable CloudIQ is checked in PowerVault Manager, performance telemetry data is sent out every 15 minutes from the PowerVault ME5

Figure 5: Audit File transfer view showing telemetry data from the ME5 series being sent to Dell

Can SCG VE discover PowerVault ME4 series arrays?
Yes - The method is different. See article SCG-VE: How to Discover PowerVault ME4 Arrays with Secure Connect Gateway