References for AirGap for Dell

Introduction

This page collects reference material for AirGap: environment-variable and configuration-file settings, the AirGap vault-network firewall/port matrix, and the AirGap audit log and built-in alarm/audit types. It is intended as a lookup reference — for step-by-step configuration, see the Configuration Guide and Vault Agent Scheduler guides.

Environment Variable Reference

The following variables are set in /opt/superna/eca/eca-env-common.conf on the Vault Agent VM (unless noted otherwise), and require an ecactl cluster down / ecactl cluster up cycle to take effect.

Variable	Purpose	Default
EVA_WAIT_FOR_OPEN_VAULT_SEC	Seconds the Vault Agent waits after opening the vault's IP interfaces, before assuming the cluster is ready.	15 seconds
EVA_NB_OF_SSH_RETRIES	Number of retry attempts for SSH commands from the Vault Agent to the PowerScale clusters, used to tune intermittent connection loss.	3 tries
EVA_SECONDS_BETWEEN_SSH_RETRIES	Wait time, in seconds, between SSH retry attempts.	10 seconds
EVA_VAULT_LOG_GATHER_PATH_ON_PROD	Production-cluster path where the vault cluster's hardware log-gather archive is written.	/ifs/data/home/eyeglass/
EYEGLASS_OPEN_VAULT_ENABLED	Enables the maintenance-window open-vault CLI request feature on the Vault Agent (disabled by default for security). See Troubleshooting for the full maintenance-window procedure.	false
TASKMASTER_AIRGAP_SCHEDULING_CRON	Cron schedule controlling how often the Vault Agent checks for new/changed AirGap policies, pushes vault alerts to Eyeglass, and checks for maintenance-window requests. See Vault Agent Scheduler for full details.	Every 2 hours

note

EVA_NTW_USE_SCRIPTS, EVA_NTW_SCRIPTS_HOST_INT_IP, EVA_NTW_SCRIPT_PRE, EVA_NTW_SCRIPT_POST, and related pre/post-script variables that apply specifically to ECS AirGap network isolation are documented in AirGap for ECS rather than repeated here.

System Configuration File Reference (system.xml)

On the Eyeglass VM, /opt/superna/sca/data/system.xml supports an <airgap> configuration section:

<airgap>
  <policyPrefix>rw-airgap-</policyPrefix>
  <logsMaxAgeInDays>7</logsMaxAgeInDays>
  <airgapJobTimeout>240</airgapJobTimeout>
</airgap>

Tag	Purpose	Default
policyPrefix	The naming prefix Eyeglass uses to recognize a SyncIQ policy as an AirGap policy.	rw-airgap-
logsMaxAgeInDays	Maximum age, in days, of retained AirGap logs.	7
airgapJobTimeout	Maximum runtime, in minutes, for an incremental AirGap sync job before it is treated as failed.	240 (4 hours)

info

Changing airgapJobTimeout is also documented step-by-step in Troubleshooting.

Firewall / Vault Network Port Reference

The following ports must be permitted across the AirGap vault network:

Port	Direction	Applies To	Description	Notes
SSH TCP 22	Production cluster ↔ Vault cluster	Outside-the-vault and Enterprise AirGap	SSH tunnel	Used to build the secure tunnel from the vault cluster to the production cluster for Ransomware Defender communications.
API 8080 TCP (HTTPS)	Production cluster → Vault cluster	Outside-the-vault only	Vault cluster API over HTTPS
SyncIQ TCP 5666, 5667, 2097, 2098, 3147, 3148	Production cluster → Vault cluster	Outside-the-vault and Enterprise AirGap	SyncIQ data replication
HTTPS 8080 API	Vault cluster → Production cluster(s)	Enterprise AirGap	Inventories production cluster resources while the vault is open
HTTPS 443 (TLS API)	Production cluster(s) → Eyeglass VM	Enterprise AirGap	Secure Vault Agent VM communications with Eyeglass/Ransomware Defender
ICMP	Vault cluster → Production cluster(s)	Enterprise AirGap	Ping used to assess network reachability and confirm vault isolation

AirGap Audit Log

The Eyeglass VM continuously audits vault-cluster reachability and writes the results to a dedicated log:

cat /opt/superna/sca/logs/AirgapAudit.log

This reachability check runs every 5 minutes.

Built-In Alarm and Audit Types

AirGap includes five built-in checks that generate immediate alarms without requiring manual monitoring:

1. AirGap Network State Alarm — validates that the AirGap network is closed when it should be closed; raises an alarm if it is detected open unexpectedly, to catch tampering.
2. AirGap Job Fails to Run — a daily check that validates all scheduled AirGap jobs actually ran as scheduled; flags an issue with the Vault Agent if a job did not execute.
3. AirGap Report — a daily HTML summary (plus CSV) covering the last 24 hours and last 30 days: success/failure counts, throughput, GB replicated, sync run time, RPO target vs. actual, and any policy running outside its normal operating range.
4. AirGap Policy Audit Monitor — inventories AirGap policies every 5 minutes and fingerprints their configuration; raises a change-audit alert if any policy property has been modified outside of expected administration.
5. Vault Cluster Disk Space Monitor — collects available vault-cluster disk space each time the vault opens for replication and raises an informational/proxy alarm, so free space can be monitored without directly connecting to the vault.

See Also

• Prerequisites – Platform, network, and hardware requirements.
• Troubleshooting – Procedures for maintenance windows, emergency stop, and job-timeout tuning.
• Vault Agent Scheduler – Full detail on vault-controlled scheduling and the TASKMASTER_AIRGAP_SCHEDULING_CRON variable.