topic Re: CIFS Connection to the domain drops in ONTAP Discussions

CIFS Connection to the domain drops

Sean1971 — Wed, 04 Jun 2025 12:58:54 GMT

I am running Data ONtap 8.0.2 7 Mode. I run CIFS on both filers. Both are setup the same. The only error I see on one filer that I don't on the second is Kerberos: Did not find principal cifs/Filer1@mydomain.com in keytab. This is a CIFS problem.

--The answer I found was rerun the CIFS setup, which runs successfully. But the error persists.

So I tried:

-resetting the computer account

-deleting and creating a new computer account

-cifs resetdc

-cifs domaininfo (looks correct)

-cifs testdc (connects to the local DCs just fine)

-setting preferred DCs

-not setting preffered DCs

-compare allthe cifs options between the two filers (the match 100%)

So I am baffled why these 2 identical filers are behaving in a similiar manner. I believe the key is

"Kerberos: Did not find principal cifs/Filer1@mydomain.com in keytab. This is a CIFS problem."

I just can't seem to find anything else to try. Any suggestions?

Re: CIFS Connection to the domain drops

COMITSUPPORT — Fri, 04 Jan 2019 12:36:24 GMT

Are you able to access a share through the IP address?

Re: CIFS Connection to the domain drops

Sean1971 — Fri, 04 Jan 2019 12:40:53 GMT

I failed to mention a couple of things:

We are using NTP on both filers and the time matches the domain time

The filers are both FAS32420

Re: CIFS Connection to the domain drops

Sean1971 — Fri, 04 Jan 2019 12:42:12 GMT

Good question. I will have to try that next time it fails. If I could or couldn't would that point you in a specific direction?

Re: CIFS Connection to the domain drops

COMITSUPPORT — Fri, 04 Jan 2019 12:48:53 GMT

Are you using Kerberos-AES Encryption? Maybe you're hitting a BUG.

Re: CIFS Connection to the domain drops

Sean1971 — Fri, 04 Jan 2019 12:54:56 GMT

I did see an article suggesting that possibility, I just would have expected to see it occur on both filers and not just the one.

Re: CIFS Connection to the domain drops

COMITSUPPORT — Fri, 04 Jan 2019 13:13:32 GMT

In the case you have one filer (vfiler) working and this filer is already joined in the same domain its worth to try and checkthe following options from CLI (working filer, non-working filer)

options cifs.signing.enabled
options cifs.ipv6.enable
options cifs.search_domains
options cifs.smb2.enable
options cifs.smb2.signing.required
options cifs.smb2_1.branch_cache.enable
options cifs.AD.retry_
options cifs.trace_dc_connection
option cifs.trace_login
options kerberos.file_keytab.realm
options kerberos.file_keytab.enable

Also, check the DNS servers and the preferred DC's configured on the working controller

Re: CIFS Connection to the domain drops

Sean1971 — Fri, 04 Jan 2019 13:41:55 GMT

The options match, at least the ones this version has available. I don't have:

options cifs.ipv6.enable

options cifs.AD.retry_

DNS and preferred DC settings are the same.

I understand that a Kerberos ticket would expire after 10 hours, so I believe that is the root of my problem. The working Filer obviously gets a new ticket, the clunky filer (which I currently hate in a way someone should not hate an inanimate object) does not get a new ticket and the CIFS drop. But why? why?

Sorry this has had be baffled for weeks now and everymorning I need to cifs resetdc to get it started. I do appreciate your suggestions very much.

Re: CIFS Connection to the domain drops

StanTech2 — Wed, 01 May 2019 19:08:22 GMT

I am having the exact same problem. Multi Path HA pair running DOT 8.0.2 7Mode. Same configuration on both filers. Every 10 hours I have to reset cifs to bring the connection back to the domain controllers.

Did you find a solution?