topic Re: how to appropirately manage default export policy on cdot? in ONTAP Discussions

how to appropirately manage default export policy on cdot?

dragontiger — Thu, 05 Jun 2025 04:30:21 GMT

The default export policy is wild open to all hosts (0.0.0.0/0), if a rule is created under this policy with specified clients, then we should be alright, this is how I understood.

My question is, should we ever use the default policy, or in what situation, it could be used. I would say we should not use it.

What would you say?

Re: how to appropirately manage default export policy on cdot?

aborzenkov — Fri, 24 Apr 2015 09:02:07 GMT

Default policy does not contain any rule, so access is denied by default. There no universal answer whether you should add rules to default policy or define your own - it all depends on your specific requirements.

Re: how to appropirately manage default export policy on cdot?

dragontiger — Thu, 21 May 2015 10:55:16 GMT

OK. Would it cause any issues if I use one volume - one policy, which means everytime I create a volume I will assigned a new policy specifically to the volume?

Re: how to appropirately manage default export policy on cdot?

chott — Thu, 21 May 2015 11:50:24 GMT

The idea behind having central policies is to enable easier administration by reusing policies.

In my opinion adding one policy per volume would defeat that purpose and would make your system cumbersom to administrate.

Just as a side note: There is a limit to the maximum number of export policies you can create depending on the cluster size:

https://fieldportal.netapp.com/Core/DownloadDoc.aspx?documentID=139294&contentID=273354

https://fieldportal.netapp.com/Core/DownloadDoc.aspx?documentID=139296&contentID=273359

https://fieldportal.netapp.com/Core/DownloadDoc.aspx?documentID=139298&contentID=273360

I think there is no one answer fits it all, as already posted.

hope that helps.

cheers chriz

Re: how to appropirately manage default export policy on cdot?

netappmagic — Thu, 21 May 2015 13:34:47 GMT

Understand that there is no one answer fits it all.

However, I am looking for a rule of thumb in creating exporting policy, if there is such. For instance, may be one policy for all related applications / projects /clients? Would that be a common rule?

Thanks for sharing.

Re: how to appropirately manage default export policy on cdot?

chott — Thu, 21 May 2015 13:42:11 GMT

Yes I think your suggestion is great.

Create an export-policy per Client / Application

cheers chriz