Understanding FPolicy

About file screening in Data ONTAP

The Data ONTAP file screening policy is set on the storage system, and specifies the types of files you want to screen.

File screening in Data ONTAP can be enabled in two ways.

Using third-party file screening software
The file screening software runs on a client that functions as a file screening server. File screening software provides flexible control and filtering of file content.

Note
For optimal performance, NetApp strongly recommends that the FPolicy server be configured on the same subnet as the storage system.
Using native file blocking
The file screening software runs natively on the storage system. Native file blocking provides simple denial of restricted file types.

Note
Native file blocking is not supported for vFiler units.

What a file policy is

A file policy determines how the storage system handles requests from individual client systems for operations such as open, rename, create, and delete. The storage system maintains a set of properties for a file policy, including, for example, the policy name and whether that file policy is active. You can set these properties for a file policy using storage system console commands.

Prerequisites for FPolicy

Licensing

FPolicy requires CIFS to be licensed and running, even in NFS-exclusive environments. To apply file policies to NFS files, you must also have NFS licensed and running. These licenses are required regardless of whether you are using third-party screening software or native file blocking.

File screening server

If you are using third-party screening software, FPolicy implementation requires a server with file screening software that is supported by Data ONTAP. You can check for client file screening software on the NetApp Partners Web page at http://www.netapp.com/partners.

Limitations of FPolicy

The following limitations apply to FPolicy:

Policies are applied to NFS and CIFS files only; policies will not be applied to files accessed by clients using other protocols.
You can create and use up to 20 file screening policies at one time.
Names for screening policies and policy types can have up to 80 characters.

How file screening works

You use file screening policies to specify files or directories with restrictions to be placed on them. Upon receiving a file operation request (such as open, write, create, or rename), Data ONTAP checks its file screening policies before permitting the operation.

If the policy specifies screening for that file based on its extension, file screening takes place either on a file screening server or on the storage system.

On a file screening server (using third-party screening software)
The file name is sent to the file screening server to be screened and the file screening server applies policies to the file name to determine whether your storage system should allow the requested file operation. The file screening server then sends a response to the storage system to either allow or block the requested file operation.
On the storage system (using native file blocking)
The request is denied and the file operation is blocked.

FPolicy with vscan

FPolicy runs independently from vscan operations. All file policies are applied to a client request before virus scanning occurs.

Vscan operations are independent of file policies. That is, vscan can open and scan files that have been blocked by file policies.