Skip to main content

How FPolicy works with external FPolicy servers

After FPolicy is configured and enabled on the storage virtual machine (SVM), FPolicy runs on every node on which the SVM participates. FPolicy is responsible for establishing and maintaining connections with external FPolicy servers (FPolicy servers), for notification processing, and for managing notification messages to and from FPolicy servers.

Additionally, as part of connection management, FPolicy has the following responsibilities:

  • Ensures that file notification flows through the correct LIF to the FPolicy server.
  • Ensures that when multiple FPolicy servers are associated with a policy, load balancing is done when sending notifications to the FPolicy servers.
  • Attempts to reestablish the connection when a connection to an FPolicy server is broken.
  • Sends the notifications to FPolicy servers over an authenticated session.
  • Manages the passthrough-read data connection established by the FPolicy server for servicing client requests when passthrough-read is enabled.
  • How control channels are used for FPolicy communication
    FPolicy initiates a control channel connection to an external FPolicy server from the data LIFs of each node participating on a storage virtual machine (SVM). FPolicy uses control channels for transmitting file notifications; therefore, an FPolicy server might see multiple control channel connections based on SVM topology.
  • How privileged data access channels are used for synchronous communication
    With synchronous use cases, the FPolicy server accesses data residing on the storage virtual machine (SVM) through a privileged data access path. Access through the privileged path exposes the complete file system to the FPolicy server. It can access data files to collect information, to scan files, read files, or write into files.
  • How FPolicy connection credentials are used with privileged data access channels
    The FPolicy server makes privileged data access connections to cluster nodes by using a specific Windows user credential that is saved with the FPolicy configuration. SMB is the only supported protocol for making a privileged data access channel connection.
  • What granting super user credentials for privileged data access means
    ONTAP uses the combination of the IP address and the user credential configured in the FPolicy configuration to grant super user credentials to the FPolicy server.
  • How FPolicy manages policy processing
    There might be multiple FPolicy policies assigned to your storage virtual machine (SVM); each with a different priority. To create an appropriate FPolicy configuration on the SVM, it is important to understand how FPolicy manages policy processing.
Related concepts
Related tasks