References for AirGap for Dell

Introduction

This page collects reference material for AirGap: environment-variable and configuration-file settings, the AirGap vault-network firewall/port matrix, and the AirGap audit log and built-in alarm/audit types. It is intended as a lookup reference — for step-by-step configuration, see the Configuration Guide and Vault Agent Scheduler guides.

Environment Variable Reference

The following variables are set in /opt/superna/eca/eca-env-common.conf on the Vault Agent VM (unless noted otherwise), and require an ecactl cluster down / ecactl cluster up cycle to take effect.

Variable	Purpose	Default
EVA_WAIT_FOR_OPEN_VAULT_SEC	Seconds the Vault Agent waits after opening the vault's IP interfaces, before assuming the cluster is ready.	15 seconds
EVA_NB_OF_SSH_RETRIES	Number of retry attempts for SSH commands from the Vault Agent to the PowerScale clusters, used to tune intermittent connection loss.	3 tries
EVA_SECONDS_BETWEEN_SSH_RETRIES	Wait time, in seconds, between SSH retry attempts.	10 seconds
EVA_VAULT_LOG_GATHER_PATH_ON_PROD	Production-cluster path where the vault cluster's hardware log-gather archive is written.	/ifs/data/home/eyeglass/
EYEGLASS_OPEN_VAULT_ENABLED	Enables the maintenance-window open-vault CLI request feature on the Vault Agent (disabled by default for security). See Troubleshooting for the full maintenance-window procedure.	false
TASKMASTER_AIRGAP_SCHEDULING_CRON	Cron schedule controlling how often the Vault Agent checks for new/changed AirGap policies, pushes vault alerts to Eyeglass, and checks for maintenance-window requests. See Vault Agent Scheduler for full details.	Every 2 hours

note

EVA_NTW_USE_SCRIPTS, EVA_NTW_SCRIPTS_HOST_INT_IP, EVA_NTW_SCRIPT_PRE, EVA_NTW_SCRIPT_POST, and related pre/post-script variables that apply specifically to ECS AirGap network isolation are documented in AirGap for ECS rather than repeated here.

System Configuration File Reference (system.xml)

On the Eyeglass VM, /opt/superna/sca/data/system.xml supports an <airgap> configuration section:

<airgap>
  <policyPrefix>rw-airgap-</policyPrefix>
  <logsMaxAgeInDays>7</logsMaxAgeInDays>
  <airgapJobTimeout>240</airgapJobTimeout>
</airgap>

Tag	Purpose	Default
policyPrefix	The naming prefix Eyeglass uses to recognize a SyncIQ policy as an AirGap policy.	rw-airgap-
logsMaxAgeInDays	Maximum age, in days, of retained AirGap logs.	7
airgapJobTimeout	Maximum runtime, in minutes, for an incremental AirGap sync job before it is treated as failed.	240 (4 hours)

info

Changing airgapJobTimeout is also documented step-by-step in Troubleshooting.

Vault Agent CLI Commands

The following commands run on the Vault Agent VM as the ecaadmin user in an Enterprise AirGap deployment.

Command	Purpose
ecactl vault open	Opens the vault interfaces from the IP pool.
ecactl vault close	Closes the vault and removes the vault interfaces from the IP pool.
ecactl airgap openvault --interval x	Opens the vault for x minutes, after which it closes automatically. This allows testing and debugging.
ecactl airgap checkopen	Shows the remaining time of a timed maintenance window request. The maintenance window time survives a Vault Agent upgrade or cluster restart.
ecactl airgap pushevents	Pushes the Vault Agent logs and events to the Eyeglass VM, for example after completing configuration tasks.
ecactl airgap list	Lists the AirGap job names.
ecactl airgap startjob --job <job name>	Runs an AirGap job from the Vault Agent VM. Use ecactl airgap list to get the job names.
ecactl jobs running	Lists the running jobs.
ecactl jobs view --follow --id <job id>	Monitors a running AirGap job, for example job-1630432432546-879575052.

For the maintenance window requests made from the Eyeglass VM with igls airgap vaultaccessrequest, igls airgap vaultaccessview, and igls airgap vaultaccesscancel, see Troubleshooting.

Vault Cluster Log Gather Automation

These commands enable automation that collects a log gather from the vault cluster and places it on the production cluster. This allows Dell Support to verify the health of the vault cluster when alarms are proxied by the Vault Agent through the Eyeglass managed devices.

Requirements: Release 2.5.8 build 228 or later.

Command	Purpose
ecactl airgap startisilonloggather	Starts the vault log gather job now.
ecactl airgap isilonloggather	Reads the log gather schedule.
ecactl airgap isilonloggather --setschedule "0 0 * * *"	Sets the schedule for the job. This example runs the job every day at midnight and is recommended for all deployments.

The log gather file is written to /ifs/data/home/eyeglass/IsilonLogs-<vault_cluster_name>.tgz on the production cluster. It can be provided to Dell Support to monitor or investigate vault hardware cluster issues. To store the file in a different location, set EVA_VAULT_LOG_GATHER_PATH_ON_PROD as described in the Environment Variable Reference.

Firewall / Vault Network Port Reference

The following ports must be permitted across the AirGap vault network:

Port	Direction	Applies To	Description	Notes
SSH TCP 22	Production cluster ↔ Vault cluster	Outside-the-vault and Enterprise AirGap	SSH tunnel	Used to build the secure tunnel from the vault cluster to the production cluster for Ransomware Defender communications.
API 8080 TCP (HTTPS)	Production cluster → Vault cluster	Outside-the-vault only	Vault cluster API over HTTPS
SyncIQ TCP 5666, 5667, 2097, 2098, 3147, 3148	Production cluster → Vault cluster	Outside-the-vault and Enterprise AirGap	SyncIQ data replication
HTTPS 8080 API	Vault cluster → Production cluster(s)	Enterprise AirGap	Inventories production cluster resources while the vault is open
HTTPS 443 (TLS API)	Production cluster(s) → Eyeglass VM	Enterprise AirGap	Secure Vault Agent VM communications with Eyeglass/Ransomware Defender
ICMP	Vault cluster → Production cluster(s)	Enterprise AirGap	Ping used to assess network reachability and confirm vault isolation

AirGap Audit Log

The Eyeglass VM continuously audits vault-cluster reachability and writes the results to a dedicated log:

cat /opt/superna/sca/logs/AirgapAudit.log

This reachability check runs every 5 minutes.

Built-In Alarm and Audit Types

AirGap includes five built-in checks that generate immediate alarms without requiring manual monitoring:

1. AirGap Network State Alarm — validates that the AirGap network is closed when it should be closed; raises an alarm if it is detected open unexpectedly, to catch tampering.
2. AirGap Job Fails to Run — a daily check that validates all scheduled AirGap jobs actually ran as scheduled; flags an issue with the Vault Agent if a job did not execute.
3. AirGap Report — a daily HTML summary (plus CSV) covering the last 24 hours and last 30 days: success/failure counts, throughput, GB replicated, sync run time, RPO target vs. actual, and any policy running outside its normal operating range.
4. AirGap Policy Audit Monitor — inventories AirGap policies every 5 minutes and fingerprints their configuration; raises a change-audit alert if any policy property has been modified outside of expected administration.
5. Vault Cluster Disk Space Monitor — collects available vault-cluster disk space each time the vault opens for replication and raises an informational/proxy alarm, so free space can be monitored without directly connecting to the vault.

See Also

• Prerequisites – Platform, network, and hardware requirements.
• Troubleshooting – Procedures for maintenance windows, emergency stop, and job-timeout tuning.
• Vault Agent Scheduler – Full detail on vault-controlled scheduling and the TASKMASTER_AIRGAP_SCHEDULING_CRON variable.