topic Re: SVM Security best practice in ONTAP Discussions

SVM Security best practice

dng_consulting — Wed, 04 Jun 2025 15:24:30 GMT

Hi all

Does someone know repercution security network or security breach for this 2 methods :

2 SVM with 2 LIF , one lif per SVM and 1 vlan per lif

and

1 SVM with 2 LIF (on the same SVM) with export policy for filter by ip/client match.

Does somewhere we should found this KB / Best Practice.

Thanks

Regards

Re: SVM Security best practice

JGPSHNTAP — Mon, 27 Feb 2017 15:23:06 GMT

Your question is slighly confusing to me.

We do one SVM with a lif on each physical from the cluster

So for example, SVM1, 2 HA pair would get 4 LIFS

In my honest opinion, unless you are in a super secure corporate environment, govt regulated or a true multi-tenant ip filtering is a complete waste of time

Re: SVM Security best practice

SYNTAXERROR — Mon, 27 Feb 2017 15:25:38 GMT

It depends on what you are doing with the 2 LIFs. If you want to use one for NFS and the other for CIFS I would use 2 SVMs because there is just one routing table per SVM.

I think it is not a security decision because then you use IPSpaces, it's more a networking/routing decision.

Regards

Dario

Re: SVM Security best practice

dng_consulting — Mon, 27 Feb 2017 16:11:52 GMT

Thanks for this response.

My customer would like isolate flux dmz and they would like have one SVM for several VLAN.

I would like to explain their that it's better and properly to segregate each environment with several SVM but i don't have the strong argument

Re: SVM Security best practice

SYNTAXERROR — Mon, 27 Feb 2017 16:12:21 GMT

There is no direct relationship between the protocols and the routing table but often you don't want to maintain a routing table for cifs when you don't know exactly in which subnets your clients live.

You can for sure create a SVM with both protocols but beware of the requirements for joining an Active Directory and the security style for the volumes.

Re: SVM Security best practice

JGPSHNTAP — Mon, 27 Feb 2017 16:22:00 GMT

agree

SVM's with ipspaces would be the way to go, one for DMZ, and one for prod network.

Don't mess with export policies to control acl's for cifs

Re: SVM Security best practice

SYNTAXERROR — Mon, 27 Feb 2017 16:31:26 GMT

I would separate DMZ and the production network with IPSpaces.

In my opinion the following arguments are used to separate SVMs:

- SVM-DR

- Domain Admins have rights on Active Directory joined SVMs

- If you use NFS SVMs for VMWare Datastore you need a user for a backup tool (like VSC) and you don't want to share the cifs volumes with this user (cloning, destroying and so on)

- Routing issues as mentioned

- Administrative issues: if for example the server team wants to administrate the CIFS Shares on their own and you don't want them to create shares on the NFS volumes

So it really depends on what you're using on this SVMs.