Hitachi VSP | Scan Requirements (StorageGuard 10.1 and later)

StorageGuard 10.1 collects configuration data from Hitachi VSP storage systems, and from the Hitachi Ops Center management layer, through four dedicated Hitachi REST data sources. Depending on your environment, StorageGuard connects directly to each array, to a central Configuration Manager server, or to Ops Center Common Services.

All collection is read-only. The StorageGuard collector sends GET requests over HTTPS and never writes data to Ops Center or the arrays.

In this article

• How StorageGuard collects Hitachi storage configurations
• Choose a connection option
• Network and security requirements
• Option A: Direct to a single array
• Option B: Centralized Configuration Manager
• Option C: Ops Center Common Services
• Create the scan service accounts
• Verify access before you scan
• Add the data source and run the first scan
• Upgrading from an earlier version
• Troubleshooting

How StorageGuard collects Hitachi storage configurations

StorageGuard 10.1 replaces the legacy Hitachi VSP probe with one data source per Hitachi component. The arrays themselves are collected by the Configuration Manager data source (Options B and C) or by the Hitachi VSP One Block data source (Option A).

Choose a connection option

Pick the option that matches which Hitachi management software is installed in your environment.

Network and security requirements

All connections are outbound HTTPS from the StorageGuard collector: the Local Scan Server in the StorageGuard appliance, or a remote mediator. Open the following ports for the components your option uses.

• HTTPS only. The Configuration Manager HTTP port (23450) is not used.
• Ops Center ships with a self-signed certificate by default.
• StorageGuard authenticates again for each scan. Configuration Manager sessions are opened per array and closed when the scan ends, and Common Services and Administrator tokens are short-lived, so no standing sessions are left behind.

Non-default ports

If an Ops Center component or array listens on a non-default port, change the port globally in StorageGuard using Scan > Advanced settings or edit it specifically for this data source by modifying the port of its associated connectivity policy.

Option A: Direct to a single array

Use this option when neither Ops Center nor a centralized Configuration Manager is installed. StorageGuard connects directly to each array's REST API through a Hitachi VSP One Block data source. Add one data source per array.

Option B: Centralized Configuration Manager

StorageGuard connects to a Configuration Manager server that manages multiple arrays. Discovery adds every VSP registered on it, so you add a single data source.

Option C: Ops Center Common Services

You add one OpsCenter Common Services data source. This does two things:

• Scans Common Services itself. StorageGuard collects its security and IAM configuration and evaluates a dedicated set of security checks against it.
• Onboards everything registered with it. Discovery reads the application services linked to Common Services, such as Configuration Manager, Administrator, and VSP One Block, and adds a data source for each automatically. The Configuration Manager data source then discovers and collects the VSP arrays, exactly as in Option B.

Create the scan service accounts

Create a read-only service account for each component your option uses. No write, provisioning, firmware, or maintenance permissions are required.

For Option C, you can use either separate accounts per component, or one account with the same user name and password configured in every component, each with that component's role. With one shared account, the data sources that discovery creates work without any credential changes.

Common Services account (Option C)

1. Log in to the Ops Center portal with an administrative account.
2. In the navigation bar, click Manage users, and then select Users from the Asset type list.
3. In the Users window, click +.
4. Enter the account information, and then click Submit.
5. Enter and confirm a password, and then click Submit.
6. Add the user to a user group that has the built-in opscenter-security-administrator role.

Ops Center Administrator account (Option C)

1. Log in to Ops Center Administrator with an administrative account.
2. Create a user for StorageGuard.
3. Assign the user the read-only Viewer role, scoped to all resource groups.

Configuration Manager account (Options B and C)

1. Create the account in Configuration Manager, either in Ops Center or on the external Configuration Manager server.
2. Define the same account, with the same user name and password, on each storage system managed by Configuration Manager. Follow the steps in Storage system account.

Storage system account (Option A, and for the Configuration Manager account)

Repeat on each storage system:

1. Log in to the SVP user interface with an administrative account.
2. On the Administration tab, click Users and Permissions, and then click New User.
3. Enter the account details. For Options B and C, use the same user name and password as the Configuration Manager account.
4. Assign the user the built-in Security Administrator (View Only) group. This group includes the three view-only roles StorageGuard needs:
   • Storage Administrator (View Only) – Hitachi's documented minimum for reading storage configuration.
   • Security Administrator (View Only) – to read user accounts, external authentication settings, and certificates.
   • Audit Log Administrator (View Only) – to read audit log and syslog settings.

Verify access before you scan

Run these checks from the StorageGuard collector host, or from a host with the same network path, using curl. Replace the values in square brackets.

Verify Configuration Manager access (Options B and C)

Use the Configuration Manager account, and [Server]:23451 as the host and port.

1. List the storage systems that Configuration Manager can reach, and note the storageDeviceId of each:

   curl -k -H "Accept: application/json" \
     https://[host]:[port]/ConfigurationManager/v1/objects/storages

   Confirm that every array you expect appears in the list.

2. Confirm that the account can open a session on an array:

   curl -k -u "[user]:[password]" -X POST \
     -H "Accept: application/json" -H "Content-Type: application/json" \
     https://[host]:[port]/ConfigurationManager/v1/objects/storages/[storageDeviceId]/sessions

   A JSON response containing a token and a sessionId confirms that the account is defined on the storage system with the correct group. Repeat for each array.

3. Close the test session:

   curl -k -X DELETE -H "Authorization: Session [token]" \
     https://[host]:[port]/ConfigurationManager/v1/objects/storages/[storageDeviceId]/sessions/[sessionId]

Verify Hitachi VSP One Block access (Option A)

Open a session with the storage system account:

curl -k -u "[user]:[password]" -X POST \
  -H "Accept: application/json" \
  https://[array]:443/ConfigurationManager/simple/v1/objects/sessions

A JSON response containing a session token confirms that the account is valid.

Verify Common Services access (Option C)

1. Request a token with the Common Services account:

   curl -k -u "[user]:[password]" -X POST \
     https://[Server]:443/portal/auth/v1/providers/builtin/token

   The response contains a bearer token, valid for 300 seconds.

2. Confirm that the role can read the security configuration:

   curl -k -H "Authorization: Bearer [token]" \
     https://[Server]:443/portal/security/v1/password-policy

   A JSON response confirms the role. An HTTP 403 means the role is insufficient; see Troubleshooting.

Verify Ops Center Administrator access (Option C)

Request a token with the Ops Center Administrator account:

curl -k -i -u "[user]:[password]" -X POST \
  https://[admin-server]:443/v1/security/tokens

An X-Auth-Token header in the response confirms that the account is valid.

Add the data source and run the first scan

1. In StorageGuard, add a new Hitachi data source of the type for your option:
   • Option A: Hitachi VSP One Block, with the array's SVP, GUM, or controller address. Repeat for each array.
   • Option B: Configuration Manager, with the Configuration Manager server.
   • Option C: OpsCenter Common Services, with the Common Services server.
2. Enter the credentials: the storage system account for Option A, the Configuration Manager account for Option B, or the Common Services account for Option C.
3. Run Discovery on the new data source. For Option B, every VSP registered on the server is added. For Option C, data sources are created for the services linked to Common Services, and the arrays are then discovered through Configuration Manager.
4. For Option C with separate accounts only: open each discovered Configuration Manager and Administrator data source, and override its credentials with that component's account. Skip this step if the same account is configured across all components.
5. Confirm that the discovered VSP systems fall within the scope of a security policy.
6. Run a scan.
7. Run Security Analysis to evaluate checks against the collected data.

Verify it worked

• Every expected VSP array appears after Discovery.
• The scan completes without collection or authentication errors on any data source.
• Security Analysis returns check results for the arrays and, for Option C, for Common Services and Administrator.

Upgrading from an earlier version

If you scanned Hitachi VSP arrays with StorageGuard 10.0.x or earlier, migrate from the legacy HiCommand probes to the new data sources after upgrading to 10.1.

1. Disable the existing Hitachi VSP (legacy HiCommand) probes.
2. Add a new Hitachi data source using one of the connection options.
3. Run Discovery on the new data source.
4. Confirm that the VSP systems fall within the scope of a security policy.
5. Run a scan.
6. Run Security Analysis to evaluate checks against the new data.
7. Verify the results against the legacy data: confirm that the same arrays appear, and review any check results that differ.
8. Remove the disabled legacy HiCommand probes.

Troubleshooting

Related articles

• Hitachi VSP | Scan Requirements (StorageGuard 9.2.x–10.0.x)
• StorageGuard 10.1 release notes

Hitachi references

• Registering a local storage system to an Ops Center API Configuration Manager connection
• Configuring a REST API environment (Ops Center API Configuration Manager REST API Reference Guide)