Enterprise Virtual Servers

Using security contexts

An EVS is configured to use an individual or global security configuration. These security configurations are referred to as contexts. If an EVS is assigned an individual security context, the settings override the default global security context settings.

To use the individual security context, the VSP One File EVS Security license key is required.

Using an individual security context

An EVS that uses the individual security context is always treated as an individual unit even if it uses the same security context settings as another EVS.

The individual security context enables multiple groups, such as departments, customers, or organizations, to share storage resources, while ensuring that groups do not have access to the data for other groups.

For example, if a server or cluster has six EVS instances, you can define individual security contexts for two of the instances so that the virtual servers are assigned to Windows domains that are different than the server or cluster domain. For network clients, access to the file systems in the two virtual servers can then be restricted or allowed by using standard network security policies such as username or user group membership.

When an EVS that uses an individual security context migrates to a different server or cluster, the EVS retains all specified security settings.

When using an individual security context for an EVS, consider the following points:

• A system administrator with sufficient privileges can move a file system from one EVS to another, but a warning is issued if the security contexts of the source and destination EVS instances are different.
• Each EVS can be configured to connect to several external name servers, and each EVS can connect to different name services.
• You must configure each EVS separately even if the virtual server uses the same individual context settings as other virtual servers.

Using the global security context

If an EVS does not have an assigned individual security context, the EVS security context defaults to the global security context.

If an EVS is assigned the global security context and the EVS migrates to a different server or cluster, the EVS uses the global settings of the server or cluster to which it migrates.

Warning: If an EVS is assigned to an individual security context and is then reconfigured to use the global security context, and the EVS was using a different Windows domain than the server or cluster, SMB names and SMB share names are no longer valid. This occurs because SMB names and share names are associated with a specific Windows domain, and the Windows domain name changed. In this scenario, you must remove all SMB names for the EVS and all SMB shares for the file systems in the EVS. Then, you must recreate the EVS SMB names and the SMB shares for the file systems in the EVS. For information about configuring SMB shares, see SMB shares.