ONTAP 9.19.1: What's new and the Storage Features that matter in production

Data Protection

SnapMirror leads this release. The changes improve data protection strategies

• SnapMirror active sync now protects NAS: SVM-level NFS/SMB on two-node AFF and four-node AFX clusters. With RPO 0 and RTO near-zero with automated failover monitored by ONTAP Mediator.
• SnapMirror active sync now supports transparent application failover for AIX, in a two-node symmetric active-active setup, with zero RPO. Details here. This removes a long-standing platform restriction for AIX databases and business apps.
• SnapMirror synchronous adds tamperproof Snapshot locking and scheduled Snapshot replication to the destination. Locked, scheduled recovery points give you options when corruption or an attack has already hit the primary.
• SnapMirror cloud jumps from 6 to 100 supported S3 buckets. Split backup targets by app, policy, tenant, or location.

NAS

• ONTAP now allocates more CPU when many clients list the same small directory (~2 MB, ~25,000 files). Automatic, no config needed. May remove the need for FlexCache workarounds.
• NAS LIF failover targets expand to any available port in the broadcast domain, on any available node — fewer stranded LIFs.
• NFSv4.2 is now managed independently of NFSv4.1. New NFS services enable it by default — check client support before you upgrade.
• NFS over TLS 1.3 encrypts NFS in transit, with optional per-LIF mutual TLS and export-policy rules that block non-TLS clients.

SAN

• Direct FC attachment is the standout change here — genuinely good news for remote and edge sites. Supported FC/FC-NVMe hosts can now connect straight to adapter ports on AFF, ASA, and FAS, with no FC switch required. Fewer components, lower cost, less to manage. Just confirm compatibility for your exact platform/adapter/host/topology combination first.
• AFF also supports active-active multipathing: all paths in the owning HA pair go active-optimized. Failover no longer waits on ALUA/ANA transitions. Still test multipathing software, timeouts, firmware, and app behavior.
• Automatic SAN LIF failover extends to iSCSI (AFF/ASA active-active configs) and NVMe/TCP (active-active multipath).
• Foreign LUN Import adds iSCSI backend connectivity, widening migration options from third-party arrays.

S3

• ONTAP S3 now enforces conditions on writes and deletes — apps can verify object state before changing it, preventing accidental overwrites.
• S3 users can hold a second access key, so key rotation no longer requires downtime.
• Cloud instances with 32 GB of memory or less get a lower S3 connection flow-control limit and shorter idle timeout by default. Test this if your apps hold many open connections.

Ransomware protection

• ARP with AI now covers primary volumes in supported SnapMirror synchronous and active sync SAN relationships. ARP Snapshots run on the primary and are not replicated.
• Upgrading restores default ARP on clusters where it was previously suppressed for synchronous replication. A pre-upgrade warning lets you opt out.
• TLS offload moves encryption to supported Ethernet cards, cutting CPU overhead. WebAuthn gets an rp-domains setting to restrict accepted Relying Party domains for FIDO2 in System Manager.
• System Manager drops the ARP baseline/surge display. Detection is unchanged — pull those stats from the CLI or REST API instead.

Before you upgrade

• Run Upgrade Advisor and the automated prechecks (errors and warnings are now separated).
• Check the Interoperability Matrix Tool and Hardware Universe for every host, adapter, protocol, NetApp Softwares (AIQ UM, nabox, snapcenter, etc) and topology involved.
• Review SAN multipathing.
• Confirm ARP behavior on synchronous-replication clusters.
• Read the full limits-and-defaults changes, not just the feature list.

Bottom line

This is an operational release. SnapMirror changes matter most, and direct FC attachment is the sleeper hit for SAN. NFS encryption and safer S3 writes solve problems teams already have. Start your evaluation wherever failover, immutable recovery, path complexity, or encryption is already costing you time.

Sources: What's new in ONTAP 9.19.1 and Changes to ONTAP limits and defaults. 

Confirm details against current NetApp Release Notes, Upgrade Advisor, Hardware Universe, and the Interoperability Matrix Tool.