NetApp Creating CIFS share -Checklist

Here is a checklist to use when creating a CIFS share in NetApp

1) Check for CIFS license
2) Create an Aggregate on the node. The aggregate would be used to host the CIFS volume.
3) Create SVM and allow the CIFS protocol.

vserver create -vserver <name> -aggr <aggr_name> -rootvolume <name> -ns-switch file -nm-switch file -rootvolume-security-style  ntfs -allowed-protocols cifs 

4) DNS configuration 

vserver service dns create -vserver <name> -domain mydomain.com -name-server <x.y.z.a>

5) CIFS setup 
vserver cifs create -vserver <name>  -cifs-server <CIFS Server Name> -ou <CN=Computers> -domain <mydomain.com> 

NetApp NFS error and troubleshooting tools

1) Mount:  Verifies the exports that are mounted on the client
2) Showmount -a <storagesystem>: Lists all mounts from a storage system
3) Showmount -e <storagesystem> List all mounts available from a storage system
4) rpcinfo -p : Helps confirm is NFS service is listed (port 2049)

Review Secd Logs
::> set diag
::*> debug log files modify -incl-files secd
::*> debug log show or ::*> debug secd log show -node <NodeName>
The secd log are located at /mroot/etc/log/mlog/secd.log

you can also use diag secd authenticate translate command to verify the name mapping
similarly, diag secd authenticate show-creds is a useful command


A way to check if client has access to an export is to use the following command:
export-policy check-access -vserver

Within autosupport look for export-rule-table, nfs-servers-by-volume etc.

NetApp NFS access denied or pemission denied

Volumes and qtrees in NetApp Clustered ONTAP are assigned export policies. The export policies define export rules that are used to authorize users.

When a user attempts to access the NFS mount, the authorization process traverses the export rules and verifies if the user matches any of the defined rules. The process stops at the first match  and if no match is found the access is denied. In such cases, the user receives an error "access denied". However, if the user access is not permitted by the rules specified in the export policy then the user receives a "permission denied" error.

Authorization and Authentication : from a storage engineers view

Authorization: is the process of verifies if a user has access to a resource (NFS export or CIFS shares). Authorization is performed using file permissions.

Authentication: Is the process of verifies who the user really is. This is performed using LDAP, NIS and/or local files.

NFSv3 services and port numbers

NFS relies on RPC port for client connections.

NFS relies on rpcbind to assign port dynamically. However, if these ports can be manually assigned using the /etc/sysconfig/nfs file.

Name of service: Port number  :: Description
NFS: 2049   :: Primary service for NFS Protocol
Portmap : 111 :: service that translates the RPC program numbers into TCP or UDP ports and enables RPC services to talk to each other
Mountd: 635 :: service that enables the server to grant remote access privileges to a restricted set of client via export control
lockd:  4045 :: NLM or lock manager a protocol to maintain lock state at the client-server level ; maintains stateful aspects of file locking
statd: 4046  :: Network status manager service that enables a client /server to inform all peers when the services is restarted so any hanging lock can be released or reclaimed.

NetApp : sending core file to NetApp

There are two way to send the system core file generated by NetApp ONTAP controllers to NetApp support.

(These files are located at /mroot/etc/crash)

They can be uploaded using the command system script upload -filename /mroot/etc/crash/<name>.nz -destination ftp://ftp.netapp.com/to-ntap/<case-id>_core.nz

or you can invoke autosupport

autosupport invoke-coredump -core-filename <core file name>.nz -case-number <case number>

Accidently deleted NetApp volume

Oops!

If you have accidentally deleted a NetApp volume then you can use the volume recovery-queue feature to recover the volume.This feature is available in 8.3 and above. The default retention is 12 hours.

Use the following commands:

1) volume recovery-queue show -vserver svm1
2) volume recovery-queue recover -vserver svm1 -volume <deleted_vol_name>