2018-03-22 05:35 AM
Customer has multiple ip adress and vlan in their svm just one of them can reach ad server and dns. Client using other lifs to connect cifs shares but sometimes cifs connections droping.
My quesiton is, the other lifs which can not reach ad and dns is causing this problem or not ? When I check logs it says this ip adress (other lifs) can not reach this dns and adress secd.conn.auth.failure.
Solved! SEE THE SOLUTION
2018-03-22 06:00 AM - edited 2018-03-22 06:02 AM
it could be both. AD and DNS having issues....
let's see what the routing look like. and then we can go furter and see you have the correct firewall rules open for the correct interface by KB:
can you print the following please?
dns show -fields name-servers -vserver <SVM name>
cifs domain discovered-servers show -vserver <SVM name> # can remove everything that is not the address. and preference
network interface show -vserver <SVM name>
network route show -vserver <SVM name>
network connections active show -Print-ip-addresses -vserver <SVM name>
2018-03-22 09:13 AM - edited 2018-03-26 01:13 AM
Your current AD and DNS connectivity:
all the other nodes cannot access the AD and DNS at the moment
for the actual config:
in a nutshell - you would need to rebuild everything around the network config (mainly to add stuff. but may gain something from removing some as well).
the reason is that your current routing very depanded on fastpath, a feature that is discontinued. https://whyistheinternetbroken.wordpress.com/2018/02/16/ipfastpath-ontap92/
iv'e started to look on each of your current use cases and routes - but they are just wrong, a workaround on top of a workaround.... with effectively only one currently valid (and another one if you sort #2 above) .
So let me put some end-goals when you re-design it:
A static route or multiple ones for the 192.168.0.0/16.range
if adding new AD LIFS. so add static routes for the DNS and AD on 10.200.120.0/24 + 10.210.154.0/24 (with setting these as pref DC)
A default route for the NAS LIFs to 10.210.224.1
i don't have real visibility of the network, and some engagement with the network admins in the organization will be required. - you would need to fully understand the client connectivity with them. and make sure you route everything optimally.
2018-03-22 01:04 PM
Thanksso much for your reply,
I will modify the routes asap.
I have just one question
Question is you said "
if client lif can not connect ad or dns, is it trying just home node other lifs to connect ad or dns?
2018-03-23 04:36 AM
each node is independent in the AD connection. if it can't reach AD locally (via the available LIFs and routing) it will deny the client request.
the SVM will not attempt to authenticate or serve the client via another node.
however - if you have some load balancing across the LIFs (like DNS round robin. DNS load balancing. or actual load balancer) the client may try to reconnect i assume and may hit different node.
2018-03-25 10:16 PM
Thanks for your detailed investigation, I opened a case from Netapp about this issue but you solved before they ask any question.
Like you said after we create ad lif for all nodes, problem solved.
Now we are going to fixed our routing problem.