PowerVault ME5: How to configure SupportAssist to Connect via Gateway Server

• About Secure Connect Gateway
• SupportAssist Configuration Pre-requisites
• Configuring PowerVault ME series with SCG/VE
  • How to discover PowerVault ME4 series arrays
  • How does SCG/VE discover the PowerVault ME5
  • Using PowerVault Manager to Connect via Gateway Server
  • Using Command Line Interface (CLI) to add the gateway server
• Viewing PowerVault ME series as a device in SCG/VE
• Troubleshooting tips and hints

Secure Connect Gateway (SCG)

SCG is available as two separate applications:  PowerVault ME5 users must use Secure Connect Gateway - Virtual Edition.

• SCG Application Edition (SCG/AE). Installs on Microsoft Windows. Replaces SupportAssist enterprise (SAE) application version and is used in environments without a hypervisor. This version can be used to monitor Dell PowerEdge servers, Dell switches and older generation Dell Storage products such as EqualLogic,PS Series, Compellent,SC Series, PowerVault MD3xxx & PowerVault ME4 series. Note: Refer to the support matrix. This version does not work with PowerVault ME5 series arrays or other Dell EMC Storage products such as Unity, PowerStore or PowerMax arrays.   

• SCG Virtual Edition (SCG/VE). This is a Linux appliance installed in a hypervisor environment. Supported hypervisors are listed in the SCG/VE support matrix accompanying the software version.  Current users of ESRS version 3.52 must upgrade to SCG/VE. SCG/VE is needed if you want to discover ALL supported devices from the Dell and EMC enterprise product range. SCG/VE V5.10.x  and later add support for the PowerVault ME5 series.

• SCG/VE Deployment and configuration guides are available online and a YouTube playlist with a series of short videos with guides to use SCG/VE are available.

• SCG/VE appliance must be able to connect to the Dell EMC secure remote server before you configure SupportAssist to Connect via Gateway Server. In the SCG/VE application click Connectivity in the header and then click Network connections and services. You can click Test connection to verify connectivity to the Global access and Enterprise servers. If SCG/VE is not operational refer to the Secure Connect Gateway Virtual Edition Troubleshooting Guide.

Configuration pre-requisites for discovery with Secure Connect Gateway

• Secure Connect Gateway Virtual edition (SCG/VE) V5.10.x and later configured and connecting to Dell EMC.  See Article:  Generate Access Key and PIN for Secure Connect Gateway 5.x, SupportAssist Enterprise Version 4.x, Dell EMC OpenManage Enterprise Connected Services, and Dell EMC products

• PowerVault ME5 must be able to resolve domain names (DNS). Ensure each controller is configured in PowerVault Manager to use a DNS server. See Configuring PowerVault ME5 to Connect via Gateway Server . 

• Access key and PIN needed to activate SupportAssist on PowerVault ME5. See Article ME5: How to generate an Access Key and Pin to enable SupportAssist

• Management network path over LAN between PowerVault ME5 series SAN array controllers and the SCG/VE appliance.

• PowerVault ME5 SAN integrated SupportAssist uses TCP port 9443  <https://SCG.VE.Management.Address:9443>  to establish a connection with the SCG/VE gateway appliance.   Attempting to connect SCG management port 5700 will not work. 

Configuring PowerVault ME series with SCG/VE

Can SCG/VE discover PowerVault ME4 series arrays?

Yes. Instructions can be found in the virtual edition user guide under the chapter Devices>Add an EqualLogic or PowerVault MD3 or ME4 device. The following YouTube video outlines the process of discovering a device.   

Note:  A security update in ME4 controller firmware GT280R010-01 and above,  prevents all SCG versions prior to v5.14.00.16 authenticating discovery. Update SCG to v5.14.00.16 or later. 

How does SCG/VE discover the PowerVault ME5?

In the SCG/VE support matrix supported devices are listed along with two discovery methods. Depending on the device there are two possible methods:

• Configure SupportAssist to connect to the secure connect gateway appliance. This method applies to PowerVault ME5 series.
• Add a device manually using the secure connect gateway user interface. This method applies to PowerVault ME4 series.

Note: If you attempt to manually add the PowerVault ME5 manually using SCG/VE management interface you will receive the following message: "This product is not able to be added from the gateway UI. Refer to the product installation documentation for connection instructions."

Administrators must follow the instructions further down to configure SupportAssist to Connect via Gateway Server,

Figure 1 -  Attempting to manually add a PowerVault ME5 in SCG/VE will fail.

Configuring PowerVault ME5 to Connect via Gateway Server

Access key and PIN to authenticate key exchange.

• PowerVault ME5 uses a two factor authentication Access key and PIN method to generate the keys needed to establish a secure connection.

• Administrators need to login using a registered business account to generate an access key and PIN to activate SCG/VE and SupportAssist on PowerVault ME5 series arrays.

For PowerVault ME5 series follow instructions in Article: ME5: How to generate an Access Key and Pin to enable SupportAssist

An access key is valid for 7 days after generation.

Configure both controllers to resolve DNS names using PowerVault Manager.

• In PowerVault manager the Network panel (Settings > Network) provides options for you to configure network-port settings, including a specifying DNS server.

• Configure both controller modules to resolve DNS (Settings > Network > DNS).

Changing the SupportAssist connection type to Gateway Server using PowerVault Manager.

Use the Support panel (Maintenance > Support) to configure SupportAssist

1. Select the SupportAssist tab
2. Check the box Connect to SupportAssist and Connect to Cloud IQ. You can sign on to the CloudIQ service later. For more information see Article: CloudIQ: General procedures to onboard PowerVault Series arrays to CloudIQ.
3. The SupportAssist agreement is displayed. Read through the agreement, then acknowledge it by selecting I accept this agreement and clicking ACCEPT AND CONTINUE.
4. In the Connection Information panel, select your connectivity options:

a. Connection Type. Select whether to Connect Directly or Connect via Gateway Server

The Primary Gateway IP is entered in the form <https://SCG.VE.Management.Address> and the Gateway Port will be <9443>

b. Proxy Details. If applicable, select Use a Proxy Server and then enter the server settings.

c. Access key and PIN. Enter the information requested. If you do not have the access key or PIN, click on request a new Access Key and PIN and follow the prompts to have new key information emailed to you. For more information see Article number 000198043: ME5: How to generate an Access Key and Pin to enable SupportAssist 

d. Click Test and Enable Connectivity. Test results are displayed, you can either go back and re-enter information, or click Continue to proceed.

5. In the Contact Information panel, enter the primary contact information and select the preferred contact settings. You can also enter information for a secondary contact
6. Click Apply changes, and click OK on the confirmation prompt.

Using Command Line Interface (CLI) to add the gateway server on PowerVault ME5 

Using Command Line Interface (CLI) to configure DNS settings.

Administrators can optionally open an SSH session to either  controller module using a terminal application such as PuTTY.

Use the following commands to configure DNS on both controllers.   Command syntax is shown by preceding the command with help. e.g.  help set dns-parameters
 

• To display DNS settings:

• show dns-management-hostname
  show dns-parameters

• To configure DNS settings:

• set dns-management-hostname name <controllerAHostname> controller A
  set dns-management-hostname name <controllerBHostname> controller B
  set dns-parameters nameservers <DNS Server 1 IP>,<DNS Server 2 IP> search-domains <mydomain.local> controller A
  set dns-parameters nameservers <DNS Server 1 IP>,<DNS Server 2 IP> search-domains <mydomain.local> controller B

Using Command Line Interface (CLI) to enable SupportAssist

Open an SSH session to either PowerVault ME5 management controller IP address. To learn the syntax options for each command precede the command with help. e.g. help set support-assist-connection and help check support-assist-connection. The commands relevant to SupportAssist configuration are listed here.

View SupportAssist configuration and operation

• show support-assist eula
  show support-assist
  show support-assist-contact
  show support-assist-telemetry-status

Configure SupportAssist

• set support-assist-connection connection-preference gateway gateway-urls https://<SCG.VE.Address:9443>
  set support-assist-proxy
  set support-assist-authentication access-key <Access Key> pin <PIN Number>
  set support-assist-contact

Test the network connection used by SupportAssist to connect to the gateway or if direct to the Dell EMC backend.

• check support-assist-connection mode gateway
  check support-assist-connection mode direct

Check if updated controller or drive firmware updates are available for the PowerVault ME5

• check support-assist-updates

Sample configuration CLI command sequence on PowerVault ME5

Note: Before you can enable SupportAssist, you must review the EULA by executing show support-assist with the eula parameter: show support-assist eula

When you enable SupportAssist for the first time, the CLI presents a confirmation to ensure you have reviewed and accept the EULA. The agreement allows remote monitoring of the storage system, collection of diagnostic information, and transmission of that data to a remote support server. Reply yes to enable the support service or no to leave it disabled.

After enabling the service, use the set support-assist-connection command to establish connectivity to the SupportAssist server, then use the set support-assist-contact command to enter customer information.

show support-assist eula
set support-assist enabled
set support-assist cloud-iq enabled
set support-assist-connection connection-preference gateway gateway-urls <https://<SCG.VE.Management.Address:9443>
check support-assist-connection mode gateway
set support-assist-authentication access-key <Access Key> pin <PIN Number>

Continue afterwards and configure a primary and secondary IT contact for your organisation using the set support-assist-contact command.

Note:  Type help before a command to learn the commands syntax and output.

Viewing PowerVault ME series as a device in SCG/VE

1. Click on Device management 
2. Select Devices

1. PowerVault ME4 arrays will appear after they have been added. (Add a device)
2. PowerVault ME5 array after  appear after  SupportAssist has been configured in PowerVault Manager to use the Secure Gateway.
3. 

Troubleshooting tips and hints

How can the network connection to SCG/VE appliance be verified from the PowerVault ME5?

1. Open an SSH session to either PowerVault ME5 controller module management IP address.
2. Confirm DNS is configured using the command: 

   show dns-parameters

3. To verify a network connection can be formed between the ME5 and SCG/VE appliance. Use the command: 

   check support-assist-connection mode gateway

# check support-assist-connection mode gateway uri https://x.x.x.x:9443 proxy false
SupportAssist Connection
------------------------
Connection State: Connected

  Endpoint
  --------
  Mode: gateway
  Endpoint: https://x.x.x.x:9443
  Status: success
  HTTP Status: 200
  Message: OK
  Status Detail: Success
  Proxy Type: none


Success: Command completed successfully. (2022-07-04 12:50:02)

A successful test will report HTTP Status: 200 and Message: OK.   HTTP Status 200 means the network connection between the ME5 array and the secure connect gateway is good and the web service is running on SCG/VE.  Message: OK means the ESRS service is running on the SCG/VE appliance.


Is telemetry data from PowerVault ME5 being send to Dell EMC?

1. Click Audit > File Transfer 
2. Filter by the PowerVault ME5 service tag.
3. If Enable CloudIQ is checked in PowerVault Manager, performance telemetry data is sent every 15 minutes from the PowerVault ME5

Figure 4 - Audit > File transfer view showing telemetry data from ME5 series being sent to Dell EMC.