PowerScale: How to migrate from Secure Remote Support (SRS) to SupportAssist?

Introduction
 

• Remote Connectivity systems on OneFS are used for sending alerts, log_gathers, usage intelligence, managed device status to Dell backend and also allows for remote dial-in by Dell Support engineers to the cluster if the cluster is configured to allow this feature

• ESRS is the default remote connectivity system in OneFS versions pror to v9.5 and is supported on OneFS 9.5+ but is expected to be decommissioned soon.

• Starting with OneFS 9.5 , SupportAssist is the recommended remote connectivity system for transmitting events, logs, and telemetry from a PowerScale OneFS cluster to Dell Support.

• There are two methods for SupportAssist to communicate with the Dell backend

  • Direct connection

  • Connection through secure connect gateway

• Secure connect gateway is the next generation consolidated connectivity solution from Dell Technologies Services, replacing SupportAssist Enterprise (SAE) and Secure Remote Services (SRS) connectivity solutions. The secure connect gateway 5.0 technology is delivered as an appliance and a stand-alone application . Secure connect gateway provides a single solution for the entire Dell EMC portfolio supporting servers, networking, data storage, data protection, hyperconverged, and converged solutions.

What is SupportAssist?

• SupportAssist integrates an Embedded Service Enabler (ESE) into OneFS and can connect to Dell Support directly or through a supported Secure Connect Gateway (SCG).
• SupportAssist is used for the following workflows:
  • CELOG sends alerts through the SupportAssist channel to Dell Support.
  • Log gather and upload
  • License activation through Dell backend
  • CloudIQ Telemetry data gather and uplaod .
  • HealthCheck definitions are updated using SupportAssist.
  • Remote Support uses SupportAssist and the Connectivity Hub to assist customers with their clusters

Obtaining an Access Key and PIN:

When upgrading your cluster, to enable SupportAssist, you must first obtain an Access Key and PIN from Dell support. To generate your Access Key and PIN, go to the Dell support access key site and enter your information. For instructions on generating your Access Key, go to the Generate Access Key and PIN for Dell Products instructions page.

SupportAssist Prerequisites:

• OneFS cluster must be running OneFS 9.5.0.0 (or later) and in a committed status. This can be verified using the below commands :

OneFS9500-1# uname -a
Isilon OneFS OneFS9500-1 9.5.0.3 Isilon OneFS 9.5.0.3 (Patch, Build B_9_5_0_005(RELEASE), 2023-05-08 00:05:53, 0x905005000000005, 9.5.0.3_LTS2023_GA-RUP_PSP-3332) amd64
OneFS9500-1# isi up view

Upgrade Status:

Current Upgrade Activity: No activity
   Cluster Upgrade State: committed
   Upgrade Process State: Not started
      Current OS Version: 9.5.0.0_build(5)style(5)
      Upgrade OS Version: N/A
        Percent Complete: 0%

Nodes Progress:

     Total Cluster Nodes: 3
       Nodes On Older OS: 3
          Nodes Upgraded: 0
Nodes Transitioning/Down: 0

LNN                                                         Version   Status
-------------------------------------------------------------------------------
1-3                                                         9.5.0.0   committed
OneFS9500-1#

• The OneFS cluster has a dedicated IPv4 network.
• The connection from SupportAssist is performed from a static network pool
• If migrating from SRS to SupportAssist, have your cluster's access key and pin ready.
• ESE User must exist and belongs to a role with ISI_PRIV_REMOTE_SUPPORT read and write access. Output should be similar to the below: 

OneFS9500-1# isi auth users view ese
                    Name: ese
                      DN: -
              DNS Domain: -
                  Domain: UNIX_USERS
                Provider: lsa-file-provider:System
        Sam Account Name: ese
                     UID: 13
                     SID: S-1-22-1-13
                 Enabled: Yes
                 Expired: No
                  Expiry: -
                  Locked: No
                   Email: -
                   GECOS: SupportAssist User
           Generated GID: No
           Generated UID: No
           Generated UPN: Yes
           Primary Group
                          ID: GID:13
                        Name: ese
          Home Directory: /nonexistent
        Max Password Age: -
        Password Expired: No
         Password Expiry: -
       Password Last Set: -
        Password Expires: Yes
              Last Logon: -
                   Shell: /usr/sbin/nologin
                     UPN: ese@UNIX_USERS
User Can Change Password: No
   Disable When Inactive: No
OneFS9500-1# isi auth mapping token ese
                   User
                       Name: ese
                        UID: 13
                        SID: S-1-22-1-13
                    On Disk: 13
                    ZID: 1
                   Zone: System
             Privileges: ISI_PRIV_LOGIN_PAPI
                         ISI_PRIV_REMOTE_SUPPORT
          Primary Group
                       Name: ese
                        GID: 13
                        SID: S-1-22-2-13
                    On Disk: 13
Supplemental Identities
                       Name: Authenticated Users
                        SID: S-1-5-11
OneFS9500-1#

• If using Secure Connect Gateway, you must use SCG version 5.x or later. Also port 9443 should be opened between the cluster and SCG. Run the below curl command from a node that is part of the SupportAssist gateway access pool to verify:

Cluster-1# curl -vk https://<IP>:9443
*   Trying <IP>:9443...
* Connected to <IP> (<IP>) port 9443
* ALPN: curl offers http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: C=US; ST=Texas; L=Round Rock; O=Dell Technologies Inc.; OU=Dell Secure Remote Services; CN=<CN>
*  start date: Nov 28 13:19:05 2023 GMT
*  expire date: Nov 28 13:19:05 2043 GMT
*  issuer: C=US; ST=Texas; L=Round Rock; O=Dell Technologies Inc.; OU=Dell Secure Remote Services; CN=<CN>
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/1.1
> GET / HTTP/1.1
> Host: <IP>:9443
> User-Agent: curl/8.4.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Thu, 06 Jun 2024 11:14:46 GMT
< Server: Apache
< Strict-Transport-Security: max-age=31536000; includeSubDomains;
< X-Frame-Options: sameorigin
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< Last-Modified: Tue, 28 Nov 2023 13:19:05 GMT
< ETag: "18-60b3643496985"
< Accept-Ranges: bytes
< Content-Length: 24
< Content-Security-Policy: frame-ancestors 'self'
< Content-Type: text/html
<
<h1>Page Not Found</h1>
* Connection #0 to host <IP> left intact

• If using direct connect, network port 443 and 8443 must be routed to Dell support.
• SRS is disabled. Enabling SupportAssist automatically disables SRS.

Enabling SupportAssist overview

To enable SupportAssist, you must perform the following steps:

1. Choose one or more static subnets or pools for outbound communication.

2. Optional: Enable SCG and specify hostname.

3. Obtain an access key and pin from the Dell Support portal.

4. Connect and provision SupportAssist ( NOTE: SRS users, enabling SupportAssist on your OneFS cluster permanently disables SRS ) 

Option 1 : Enabling SupportAssist - connect directly to Dell support

Enable SupportAssist to connect directly to Dell support by performing the following commands:

• To choose one or more static subnets and pools for outbound communication, enter the following command where is the chosen static subnet and pool"

isi supportassist settings modify --network-pools="<subnet0.pool0>"

• Direct connection mode is the default option. To enable direct connection mode, enter the following command:

isi supportassist settings modify --connection-mode direct

• If you are using an access key and pin, to connect to Dell support and enable SupportAssist, enter the following command where and are the access key and PIN provided to you from the Dell support portal:

isi supportassist provision start --access-key <key> --pin <pin>

• If you are using a hardware key, to connect to Dell support and enable SupportAssist, enter the following command:

isi supportassist provision start

• Monitor provision status using the below command

isi supportassist provision view -i

Option 2 : Enabling SupportAssist - Secure Connect Gateway
 

Enable SupportAssist to connect to a Secure Connect Gateway (SCG) by performing the following commands:

• To choose one or more static subnets and pools for outbound communication, enter the following command where is the chosen static subnet and pool:

isi supportassist settings modify --network-pools="<subnet0.pool0>"

• To enable the SCG connection mode, enter the following command:

isi supportassist settings modify --connection-mode gateway

• To point SupportAssist to your SCG, enter the following command, where is the hostname of your SCG

isi supportassist settings modify --gateway-host <hostname> --gateway-port <integer>

• If you are using an access key and pin, to connect to Dell support and enable SupportAssist, enter the following command where and are the access key and PIN provided to you from the Dell support portal:

isi supportassist provision start --access-key <key> --pin <pin>

• If you are using a hardware key, to connect to Dell support and enable SupportAssist, enter the following command:

isi supportassist provision start

• Monitor provision status using the below command

isi supportassist provision view -i