Views:
When using the File Security Virtual Appliance (FSVA) deployed as a Service Gateway instance, the scanner (gRPC) and management (WebSocket) endpoints are built into the appliance and served on port 443. Enabling ONTAP agent support therefore requires only the network access and TLS trust setup described in the following sections.

Endpoints

Service
Protocol
Endpoint
Port
Scanner (gRPC) gRPC over TLS <instance IP> 443
Management (WebSocket) WSS <instance IP>/ontap 443
These correspond to the Scanner Service endpoint and Management Service endpoint fields in the ONTAP agent installer.

Network requirements

Ensure the following inbound rule is open on the Service Gateway instance security group (or equivalent firewall):
Type
Protocol
Port
Source
Reason
HTTPS/WSS/gRPC TCP 443 Vscan server IP / CIDR ONTAP agent scanner + management traffic
Note
Note
Port 443 is already required for SDK scan clients per the FSVA Inbound/Outbound Configuration. If you previously opened 443 only to your SDK client CIDRs, expand the source to include the Vscan server IP as well.

TLS certificate setup (self-signed)

The scanner (gRPC) and management (WSS) endpoints serve TLS on port 443. For lab/test deployments you can use a self-signed certificate; for production, use a CA-signed certificate. The certificate's SAN must include the instance IP or DNS name that clients (the Vscan server, ONTAP agent, and SDK clients) connect to, or TLS verification will fail.
  1. Generate a self-signed server certificate (CN + SAN).
    Run on any machine with openssl. Replace the IP with your instance IP, and adjust the DNS SAN if clients connect by hostname:
    openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
  -keyout mysg.key -out mysg.pem -subj "/CN=*.sgi.visionone.trendmicro.com" \
  -addext "subjectAltName=DNS:*.sgi.visionone.trendmicro.com,IP:172.31.91.108"
# Bundle key + cert into one PEM (this is what the SG import expects)
cat mysg.key >> mysg.pem
  2. Import the certificate into the Service Gateway instance.
    In the TrendAI Vision One™ console, go to Service Gateway Management → select your SG appliance → Settings, and upload mysg.pem (the combined key+cert) as the server certificate. For more information, see Configure Service Gateway settings.
  3. Import the certificate on a Windows client (system-wide trust).
    Copy mysg.pem to the Windows client (for example, to C:\certs\), then trust it in the Windows certificate store so any client (including tmfs-cli) picks it up:
    1. Rename/copy mysg.pem → mysg.crt and either:
      • Use the GUI:
        Double-click mysg.crt → Install Certificate → Local Machine → Place all certificates in the following store → Trusted Root Certification Authorities
      • Use PowerShell (run as Administrator):
        Import-Certificate -FilePath C:\certs\mysg.crt -CertStoreLocation Cert:\LocalMachine\Root
        Note
        Note
        The PEM bundle from step 1 also contains the private key. For the client trust store you only need the public cert — either import the .crt as above (Windows ignores the key portion on import), or strip the key first by copying only the -----BEGIN CERTIFICATE----- … -----END CERTIFICATE----- block into mysg.crt.

Test the endpoints

Before installing the ONTAP agent, verify both endpoints from the Vscan server:
Management Service (expect 401 — confirms connectivity, not authentication):
websocat --exit-on-eof wss://<instance IP>/ontap
Scanner Service:
tmfs scan file:<sample-file> --endpoint=<instance IP>

Generate an onboarding token for the ONTAP agent

  1. Log in to the Service Gateway instance as sgowner
  2. Find the management service container. All FSVA containers run in a single pod under the sg-sfs-scanner namespace. Get the current pod name:
    kubectl get pods -n sg-sfs-scanner
    For further kubectl operations on the Service Gateway instance, refer to KA-0014380.
  3. Exec into the management service container:
    kubectl exec -it <pod-name> -n sg-sfs-scanner -c sg-sfs-scanner-management-service -- bash
    Example:
    kubectl exec -it sg-sfs-scanner-6db74d58c-47g5p -n sg-sfs-scanner -c sg-sfs-scanner-management-service -- bash
  4. Create an agent slot and issue an onboarding token:
    clish agent create --name <agent-name>
clish agent onboarding-token issue --instance <agent-name>

Install the ONTAP agent

  • Download the ONTAP agent installer (MSI).
  • Install on the Windows Vscan server.
  • Configure the ONTAP agent with:
    • Generated onboarding token
    • Scanner Service endpoint: <instance IP>
    • Management Service endpoint: <instance IP>/ontap

Configure the ONTAP agent with the Management Service

  1. Exec into the management service container.
  2. Check the agent connection status:
    clish agent show --instance <agent-name>
  3. Configure privileged-user credentials:
    clish agent credential modify --instance <agent-name>

Verification

Run vserver vscan connection-status show-all on the ONTAP management console and verify the agent connection status via clish agent show.