Dell Unity™ Family Configuring SupportAssist

Notes, Cautions, and Warnings

[Note]: A NOTE indicates important information that helps you make better use of your product.

[Caution]: A CAUTION indicates either potential damage to hardware or loss of data and tells you how to avoid the problem.

[Warning]: A WARNING indicates a potential for property damage, personal injury, or death.

Chapter 1: Introduction

About this document

This document provides information for configuring and managing SupportAssist on a Unity system with operating environment (OE) version 5.3 or later. SupportAssist is relevant only to physical deployments.

[Note]: UnityVSA does not support SupportAssist. Centralized ESRS is used for remote support. Refer to Unisphere online help and the Unity Family Secure Remote Service Requirements and Configuration document for details.

Additional resources

Software and hardware revisions are periodically released. Some functions described may not be supported by all current software or hardware versions. Product release notes provide the most up-to-date information. Contact your technical support professional for assistance if a product does not function as described.

Where to get help

• Product information: For documentation or release notes, visit Unity Technical Documentation at: dell.com/unitydocs.
• Troubleshooting: For product, software, licensing, and service information, visit Support (registration required) at: dell.com/support.

Benefits of SupportAssist

SupportAssist provides a secure, remote connection between your Unity environment and Dell Support, offering benefits such as:

• Automated health checks.
• 24x7 predictive wellness monitoring.
• Remote issue analysis and diagnosis.
• Enhanced Online Support experience with actionable, real-time data-driven insights via the MyService360 dashboard.
• Remote delivery of Dell's service and support.
• CloudIQ integration for intelligent analytics on performance, capacity, and configuration for health-based reporting and remediation.

[Note]: SupportAssist must be enabled on your storage system to send data to CloudIQ.

Connection Type options for SupportAssist

SupportAssist offers two connection types for sending storage system information to the Support Center:

• Connect Directly
• Connect through a Gateway Server

Remote service connectivity options include:

• Inbound connectivity for remote access and RSC (Remote Secure Credentials - Recommended): Allows authorized Dell support engineers to securely troubleshoot your system remotely using unique, one-time Dell-generated credentials.
• Inbound connectivity for remote access only: Allows both outbound and inbound traffic for remote service. Requires your system administrator to provide Dell support engineers with an access credential.
• Outbound traffic only: Allows only outbound traffic for remote service.

[Note]: To enable and configure SupportAssist, you must accept the SupportAssist End User License Agreement (EULA). Enabling SupportAssist is strongly recommended for faster problem diagnosis and resolution. Failure to enable it may require manual data collection for support.

Connect Directly

This option runs SupportAssist directly on the storage system, establishing a secure connection to the Support Center. Ensure ports 443 and 8443 are open for outbound traffic. For SSH remote access, ensure ports 22 and 8443 are open.

Connect through a Gateway Server

This option requires a separate customer-supplied server running Secure Connect Gateway (version 5.12.00.10 or later). It allows managing multiple storage systems via a single, centralized secure connection. The Secure Connect Gateway acts as a communication broker.

[Note]: ESRS gateway (version 3.x) or SupportAssist Enterprise (version 4.y) are not supported. Only Secure Connect Gateway is supported.

You can configure Primary and Secondary gateways for high availability. Both gateways should ideally reside on the same cluster.

HTTP proxy servers are supported; SOCKS proxy servers are not. A Policy Manager can be used with Secure Connect Gateway.

[Note]: For more information on Secure Connect Gateway and Policy Manager, refer to the Secure Connect Gateway product page on Online Support.

For Connect through a Gateway Server, ensure port 9443 is open between the Unity system and the Secure Connect Gateway server. For SSH remote access, ensure ports 22 and 8443 are open.

[Note]: Storage systems are added via Unisphere or UEMCLI. Unisphere requires port 80; UEMCLI requires port 443. Adding from the gateway server may show connection but not data transfer.

Remote Secure Credentials (RSC)

RSC is disabled by default. When enabled, it allows authorized Dell support engineers to authenticate using a unique, one-time Dell-generated credential, eliminating the need for administrator-provided credentials. This grants administrator and service roles for UEMCLI commands and a service role for on-array CLI commands.

Operational description

SupportAssist provides an IP-based connection for receiving error files and alerts, enabling remote troubleshooting for faster resolution.

[Note]: Enabling SupportAssist is strongly recommended for faster diagnosis and resolution. If not enabled, manual data collection may be required.

SupportAssist and security

SupportAssist employs multiple security layers:

• Notifications originate from your site and are secured with AES-256 bit encryption.
• IP-based architecture integrates securely with your infrastructure.
• Communications are bilaterally authenticated using RSA digital certificates.
• Only authorized Customer Service professionals with two-factor authentication can download digital certificates.

With RSC enabled, Dell Support uses dynamic RSA passcodes valid for 30 minutes, authenticated by Dell backend servers, granting specific roles and logging all activities.

SupportAssist management

SupportAssist can be managed via Unisphere, UEMCLI, or REST API. You can enable/disable the service and configure proxy settings.

Connect Directly is an embedded managed service with High Availability (HA) features. Connect through a Gateway Server supports Primary/Secondary gateways for HA.

SupportAssist operates on the primary SP in normal mode, not service mode.

SupportAssist communication

A DNS server is required. If a global proxy server is configured, SupportAssist uses it; otherwise, it communicates directly with the Support Center.

Chapter 2: Requirements, Restrictions, and Configuration

Prerequisites for SupportAssist

To enable SupportAssist, your Unity system requires:

• Operating environment (OE) version 5.3 or later.
• Unity system initialized (universal key present).

[Note]: SupportAssist initializes during manufacturing for new systems (OE 5.3+). For upgrades to OE 5.3+ with prior ESRS configuration, initialization occurs during the upgrade. Initialization may fail if: Integrated or Centralized ESRS is not configured before upgrade; a universal key is missing (requires manual key/PIN acquisition); or if using older ESRS gateways (3.x) or SupportAssist Enterprise (4.y) instead of Secure Connect Gateway (5.12.00.10+); or if the system could only connect via a proxy before upgrade.

[Note]: Automatic conversion from integrated ESRS to SupportAssist during upgrade is only successful for systems with direct public network connectivity.

• At least one DNS server must be configured.
• Unrestricted network access to the Support Center backend (esrs3-core.emc.com) via HTTPS is required (for non-proxy environments).
• Avoid dynamic IP addresses (DHCP) for Secure Connect Gateway components or managed devices unless FQDNs are configured.
• Network traffic over ports 443 and 8443 is required for SupportAssist and remote support tasks.
• For SSH remote access, ensure ports 22 and 8443 are open.
• SSL/TLS inspection and certificate proxying are not permitted for SupportAssist traffic.

[Note]: Direct connect does not require an IP address. If DHCP is used for SupportAssist components, static IP addresses are required, and leases must not expire. FQDNs can be used instead of IP addresses for gateway connections.

Requirements for SupportAssist with Connect Directly connectivity

• Network traffic (HTTPS) must be permitted on ports 443 and 8443 (outbound) to the Support Center.
• If SSH remote access is required, ports 22 and 8443 must be open.
• If a global proxy server is used, it must be indicated during configuration.

Requirements for SupportAssist with Connect through a Gateway connectivity

• Network traffic (HTTPS) must be permitted on port 9443 between the Unity system and the Secure Connect Gateway server. Port 443 is also required for SupportAssist functionality.
• [Note]: For SSH remote access, ensure ports 22 and 8443 are open.
• [Note]: Unisphere remote sessions require port 80; UEMCLI requires port 443.
• Secure Connect Gateway server must be version 5.12.00.10 or later.
• At least one Secure Connect Gateway server must be operational.
• Secure Connect Gateway server must be configured with an IPv4 address or FQDN.
• [Note]: IPv6 is not supported.
• [Note]: Do not manually add/remove Unity systems from a Secure Connect Gateway server; use the Unisphere SupportAssist configuration wizard.

General SupportAssist restrictions and limitations

• Policy manager settings are not transferred during upgrades from pre-5.3 OE if configured for Integrated ESRS.
• [Note]: Policy Managers and proxy servers are supported in OE 5.3 for Connect through a gateway server, configured via Secure Connect Gateway.
• Upgrades are blocked if Integrated ESRS is enabled with a SOCKS proxy. SupportAssist does not support SOCKS proxies; HTTP proxies are required for OE 5.3+.
• Unity systems with older ESRS gateways (3.x) or SupportAssist Enterprise (4.y) cannot be upgraded to OE 5.3. SupportAssist only supports Secure Connect Gateway version 5.12.00.10+.
• IPv6 is not supported for SupportAssist.
• [Note]: Systems with only IPv6 management IP addresses will not function with SupportAssist. IPv6 proxy addresses are not supported.
• If the SupportAssist service is in an unknown state with Connect Directly, Connect through a gateway server cannot be enabled.
• Issues with universal keys or reinitialization to pre-OE 5.3 releases can cause SupportAssist upgrade failures.
• Remote access state in Unisphere might differ from the Support Center backend when using a gateway connection.
• Remote access and RSC can stop working without notification if the Secure Connect Gateway server is reinstalled.
• False success indications may appear when switching to a non-communicating Secure Connect Gateway.
• Misleading proxy configuration errors may appear if there's an issue with the Secure Connect Gateway or backend server.
• Connection issues between the gateway and backend may not generate alerts.
• Active remote connections from Dell Support cannot be terminated by the user; they must be terminated by Dell Support.
• System cleanup only removes local data, not data from SCG or backend servers, potentially allowing continued remote login.
• Changes to direct connection proxy settings require restarting the SupportAssist service (e.g., svc_supportassist -r service).
• [Note]: For service commands, see the Dell Unity Family Service Commands Technical Notes document.
• Automatic upgrade to SupportAssist from Integrated ESRS is not supported if the Unity system connects only via a proxy server and is upgraded from OE 5.2 or earlier to 5.3 or later.
• [Note]: For more details, see Knowledge Base Article 000210339.

How to enable and configure SupportAssist

SupportAssist can be enabled and configured in Unisphere via:

• Initial Configuration wizard
• System > Service > Overview
• Settings > Support Configuration > SupportAssist
• UEMCLI (command line interface)
• Unisphere Management REST API server

SupportAssist status is indicated by a check mark within a green circle under SupportAssist in System > Service > Overview.

Typical use cases for enabling SupportAssist

• New Unity system with SupportAssist initialized during manufacturing.
• Unity software upgrade (earlier than 5.3 to 5.3+ with prior ESRS).
• Unity software upgrade (earlier than 5.3 to 5.3+ without prior ESRS).
• Unity software upgrade (5.3.x to 5.4+ with SupportAssist configured).
• Unity software upgrade (5.3.x to 5.4+ without SupportAssist configured).

Upgrades from earlier versions to 5.3+ with ESRS enabled automatically enable SupportAssist. Upgrades from versions earlier than 5.3 require manual RSC enablement if used. If ESRS is not enabled before upgrade, SupportAssist is not enabled.

Upgrades from 5.3.x to 5.4+ with Direct Connect or Gateway enabled automatically enable SupportAssist. RSC is also automatically enabled if previously selected. If RSC is not enabled before upgrade, it is not enabled automatically. If SupportAssist is not enabled before upgrade, it remains disabled.

[Note]: Pre-upgrade health checks can block upgrades to OE 5.3+. These include issues with SOCKS proxies or outdated ESRS/Secure Connect Gateway versions.

Configuring SupportAssist settings

• License Agreement: Accept the EULA.
• Connection Type: Select Connect Directly or Connect through a Gateway Server (outbound only, inbound/outbound, or inbound/outbound with RSC). Disabling is not recommended.
• Network check: Validates network readiness. Shows proxy settings if 'Use Global Proxy Settings' is checked.
  • Proxy Enabled: Indicates status.
  • Protocol: HTTP (default) on port 3128.
  • Proxy server IP address: Network address.
  • Credentials: Username and password.
• Initialize (for uninitialized systems): Requires an access key from the Dell Key Portal and a 4-digit PIN.
• Review Configuration: Displays selected settings and operation results.
• Results: Indicates successful enablement.

[Note]: CloudIQ is enabled by default when SupportAssist is enabled.

Configuring SupportAssist workflow for a new Unity system

The Initial Configuration wizard in Unisphere guides you through enabling SupportAssist. If skipped, it can be enabled later via Overview, Settings, UEMCLI, or REST API.

Steps in Unisphere:

1. Accept License Agreement.
2. Select Connection Type (Connect Directly or Connect through a Gateway Server). Enabling remote access allows inbound/outbound traffic; disabling allows only outbound. RSC requires inbound connectivity.
3. Run Network Check to validate readiness.
4. Review Configuration.
5. In Results, manage the CloudIQ checkbox (enabled by default).

Configuring SupportAssist workflow when ESRS is not configured prior to upgrade

If SupportAssist conversion is blocked during an upgrade, it must be manually enabled. This can occur if Unity did not have ESRS enabled prior to upgrade, or if the access key is lost/corrupted.

Steps in Unisphere:

1. Accept License Agreement.
2. Select Connection Type.
3. Run Network Check.
4. For Initialize, obtain an access key from the Dell Key Portal using the system serial number and a PIN.
5. Review Configuration.
6. In Results, manage the CloudIQ checkbox.

Chapter 3: Configuring SupportAssist

Configure SupportAssist on a new system

Prerequisites

[Note]: This procedure is for initialized systems. Use the "Configure SupportAssist when the Unity system is not initialized" procedure for uninitialized systems.

• Unity OE version 5.3 or later.
• System initialized (universal key present).
• If using a proxy server, it must be HTTP, configured, and operating. SOCKS proxies are not supported.
• At least one DNS server configured.
• Unrestricted network access to Support Center backend (esrs3-core.emc.com) via HTTPS.
• Network traffic over ports 443 and 8443 required for SupportAssist and remote support.
• For Connect through a Gateway server:
  • Network traffic (HTTPS) on port 9443 between Unity and Secure Connect Gateway.
  • Secure Connect Gateway server version 5.12 or later.
  • At least one Secure Connect Gateway server operational.
• If SSH remote access is required, ports 22 and 8443 must be open.

About this task

To configure the initial setup of SupportAssist:

1. Navigate in Unisphere: If using the Initial Configuration wizard, proceed to step 5. If SupportAssist was skipped, go to step 2.
2. Select the Settings icon.
3. Select Support Configuration.
4. From the dropdown, select SupportAssist.
5. Click Configure.
6. Accept the License Agreement (EULA).

Connection Type options appear.

Specify Connection Type options

8. Click Next.
9. Configure Proxy Settings:
   • Leave 'Use Global Proxy Settings' unchecked (default).
   • Or, select 'Use Global Proxy Settings'. [Note]: If selected, current global proxy settings are used. SOCKS proxies are not supported; HTTP proxies are required.
10. Click Next to run a Network check.
11. Review Configuration.
12. Click Finish. Results will show success after a few minutes. CloudIQ is enabled by default.
13. Manage CloudIQ checkbox (enabled by default).
14. Click Close.

Next steps

Always test connectivity after configuring SupportAssist. Click Test in System > Service or Settings > Support Configuration.

[Note]: If status does not change after 10 minutes, contact Support. Click Refresh to update status.

To change configuration, select Change. The wizard reappears.

[Note]: For Unity OE 5.4+, RSC option may not appear if previously selected.

Configure SupportAssist when the Unity system is not initialized

Prerequisites

[Note]: Use this procedure only if the Unity system is NOT initialized. For initialized systems, use the "Configure SupportAssist on a new system" procedure.

• Unity OE version 5.3 or later.
• System is NOT initialized (universal key not present).
• If using a proxy server, it must be HTTP, configured, and operating. SOCKS proxies are not supported.
• At least one DNS server configured.
• Unrestricted network access to Support Center backend (esrs3-core.emc.com) via HTTPS.
• Network traffic over ports 443 and 8443 required for SupportAssist and remote support.
• For Connect through a Gateway server:
  • Network traffic (HTTPS) on port 9443 between Unity and Secure Connect Gateway.
  • Secure Connect Gateway server version 5.12 or later.
  • At least one Secure Connect Gateway server operational.
• If SSH remote access is required, ports 22 and 8443 must be open.

About this task

To configure SupportAssist using Unisphere:

1. Select the Settings icon.
2. Select Support Configuration.
3. From the dropdown, select SupportAssist.
4. Click Configure.
5. Accept the License Agreement (EULA).

Connection Type options appear.

Specify Connection Type options

7. Click Next.
8. Configure Proxy Settings:
   • Leave 'Use Global Proxy Settings' unchecked (default).
   • Or, select 'Use Global Proxy Settings'. [Note]: If selected, current global proxy settings are used. SOCKS proxies are not supported; HTTP proxies are required.
9. Click Next to run a Network check.
10. Initialize: Note the system serial number and click the Key Portal hyperlink to generate an access key.
11. Click Generate Access Key on the Dell Support page.
12. Enter the system serial number and click Search.
13. Create a 4-digit PIN.
14. Click Generate Access Key. An email with the access key and expiration date will be sent.
15. Enter the access key and PIN in the Initialize fields.
16. Click Next.
17. Review Configuration.
18. Click Finish. Results will show success after a few minutes. CloudIQ is enabled by default.
19. Manage CloudIQ checkbox (enabled by default).
20. Click Close.

Next steps

Always test connectivity after configuring SupportAssist. Click Test in System > Service or Settings > Support Configuration.

[Note]: If status does not change after 10 minutes, contact Support. Click Refresh to update status.

To change configuration, select Change. The wizard reappears.

[Note]: For Unity OE 5.4+, RSC option may not appear if previously selected.

View and Manage SupportAssist settings

Prerequisites

SupportAssist EULA accepted and SupportAssist initially configured.

About this task

View current SupportAssist configuration and status, change connection types, test connections, and send test alerts. Modifications are made via the Configure SupportAssist wizard, accessible through Settings > Support Configuration > SupportAssist or System > Service > Overview > SupportAssist.

Steps

1. Navigate in Unisphere:
   • Settings > Support Configuration > SupportAssist
   • System > Service > Overview > SupportAssist

   Current settings are displayed. [Note]: For Unity OE 5.4+, RSC option may not appear if previously selected.

2. Perform actions as needed:
   • Send a test alert by clicking the Test control.
   • Change Connection Type by clicking Change (Settings) or Edit (System > Service). [Note]: If changing to Connect through a gateway server, the same address cannot be used for primary and secondary gateways.
   • After changes, proceed to Network Check, then Next. Review Configuration, then Finish.
   • Disable SupportAssist by selecting Disable (not available via System > Service > Overview > SupportAssist). Confirm the action.
   • Manually refresh SupportAssist configuration/state by clicking the Refresh icon (not available via Settings > Support Configuration > SupportAssist).