Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon FSx File Gateway is no longer available to new customers. Existing customers of FSx File Gateway can continue to use the service normally. For capabilities similar to FSx File Gateway, visit this blog post.

File Gateway setup requirements

Unless otherwise noted, the following requirements are common to all File Gateway types in Amazon Storage Gateway. Your setup must meet the requirements in this section. Review the requirements that apply to your gateway setup before you deploy your gateway.

Prerequisites

Before you set up your Amazon FSx File Gateway (FSx File Gateway), you must meet the following prerequisites:

Hardware and storage requirements

The following sections provide information about the minimum required hardware and storage configurations for your gateway, and the minimum amount of disk space to allocate for the required storage.

Hardware requirements for on-premises VMs

When deploying your gateway on-premises, ensure that the underlying hardware on which you deploy the gateway virtual machine (VM) can dedicate the following minimum resources:

Requirements for Amazon EC2 instance types

When deploying your gateway on Amazon Elastic Compute Cloud (Amazon EC2), the instance size must be at least xlarge for your gateway to function. However, for the compute-optimized instance family the size must be at least 2xlarge.

Use one of the following instance types recommended for your gateway type.

Recommended for File Gateway types

Storage requirements

In addition to 80 GiB of disk space for the VM, you also need additional disks for your gateway.

Network and firewall requirements

Your gateway requires access to the internet, local networks, Domain Name Service (DNS) servers, firewalls, routers, and so on.

Network bandwidth requirements vary based on the quantity of data that is uploaded and downloaded by the gateway. A minimum of 100Mbps is required to successfully download, activate, and update the gateway. Your data transfer patterns will determine the bandwidth necessary to support your workload.

Following, you can find information about required ports and how to allow access through firewalls and routers.

Port requirements

FSx File Gateway requires specific ports to be allowed through your network security for successful deployment and operation. Some ports are required for all gateways, while others are required only for specific configurations, such as when connecting to VPC endpoints.

For FSx File Gateway, you must use Microsoft Active Directory to allow domain users to access a Server Message Block (SMB) file share. You can join your File Gateway to any valid Microsoft Windows domain (resolvable by DNS).

You can also use the Amazon Directory Service to create an Amazon Managed Microsoft AD in the Amazon Web Services Cloud. For most Amazon Managed Microsoft AD deployments, you need to configure the Dynamic Host Configuration Protocol (DHCP) service for your VPC. For information about creating a DHCP options set, see Create a DHCP options set in the Amazon Directory Service Administration Guide.

The following table lists the necessary ports and describes conditional requirements in the Notes column.

Port requirements for FSx File Gateway

Networking and firewall requirements for the Storage Gateway Hardware Appliance

Each Storage Gateway Hardware Appliance requires the following network services:

There are five physical network ports at the rear of the Dell PowerEdge R640 server. From left to right (facing the back of the server) these ports are as follows:

You can use the iDRAC port for remote server management.

A hardware appliance requires the following ports to operate.

To perform as designed, a hardware appliance requires network and firewall settings as follows:

All IP addresses on the same network interface (NIC), whether for a gateway or a host, must be on the same subnet. The following illustration shows the addressing scheme.

For more information about activating and configuring a hardware appliance, see Using the Amazon Storage Gateway Hardware Appliance.

Allowing Amazon Storage Gateway access through firewalls and routers

Your gateway requires access to the following service endpoints to communicate with Amazon. If you use a firewall or router to filter or limit network traffic, you must configure your firewall and router to allow these service endpoints for outbound communication to Amazon.

The following service endpoint is required by all gateways for head-bucket operations.

bucket-name.s3.region.amazonaws.com.cn:443

The following service endpoints are required by all gateways for control path (anon-cp, client-cp, proxy-app) and data path (dp-1) operations.

anon-cp.storagegateway.region.amazonaws.com.cn:443
client-cp.storagegateway.region.amazonaws.com.cn:443
proxy-app.storagegateway.region.amazonaws.com.cn:443
dp-1.storagegateway.region.amazonaws.com.cn:443

The following gateway service endpoint is required to make API calls.

storagegateway.region.amazonaws.com.cn:443

The following example is a gateway service endpoint in the US West (Oregon) Region (us-west-2).

storagegateway.us-west-2.amazonaws.com.cn:443

In addition to the Storage Gateway and Amazon S3 service endpoints, Storage Gateway VMs also require network access to the following NTP servers:

0.amazon.pool.ntp.org
1.amazon.pool.ntp.org
2.amazon.pool.ntp.org
3.amazon.pool.ntp.org

Configuring security groups for your Amazon EC2 gateway instance

In Amazon Storage Gateway, a security group controls traffic to your Amazon EC2 gateway instance. When you configure a security group, we recommend the following:

Supported hypervisors and host requirements

You can run Storage Gateway on-premises as either a virtual machine (VM) appliance or a physical hardware appliance, or in Amazon as an Amazon EC2 instance.

Storage Gateway supports the following hypervisor versions and hosts:

Supported SMB clients for File Gateway

File Gateway supports the following Service Message Block (SMB) clients:

Supported file system operations for File Gateway

Your SMB client can write, read, delete, and truncate files. When clients send writes to Storage Gateway, it writes to local cache synchronously. Then it writes to Amazon FSx asynchronously through optimized transfers. Reads are first served through the local cache. If data is not available, it's fetched through Amazon FSx as a read-through cache.

Writes and reads are optimized in that only the parts that are changed or requested are transferred through your gateway. Deletes remove files from Amazon FSx.