topic Re: Issue with SSH to nas Vserver in ONTAP Discussions

Issue with SSH to nas Vserver

elic_co — Wed, 04 Jun 2025 12:07:59 GMT

Hey,

I have a cluster consisting of 4 nodes, two "long existing" FAS9000 and 2 recently added A200.

All nodes are running 9.5P8.

Now I have a NAS vserver providing CIFS & NFS services.

The vserver has 1 mgmt ip with data role and none data-protocols, and 4 data ips (one on each node) with cifs and nfs data-protocols and data firewall policy.

the issue is that the ips that reside on nodes 1&2 are reachable through ssh although ssh is not permitted in the firewall policy.

lifes 3&4 that are newer and reside on the A200 (created after 1&2) are not reachable through ssh and the configuration for all the lifs seem to be identical.

I tried to bring lifs 1&2 down for a few seconds and then up and also change their firewall policy to mgmt and then back to data but it didn't help.

Does anyone have an idea why this might happen and how to resolve this?

Thanks!

Re: Issue with SSH to nas Vserver

Ontapforrum — Sun, 24 Nov 2019 23:19:05 GMT

Hi,

Could you share this output:

::> system services firewall policy show
::> network interface show -fields firewall-policy,lif,address

Note:firewall-policy 'mgmt' applies to both node-mgmt & cluster-mgmt.

Re: Issue with SSH to nas Vserver

elic_co — Mon, 25 Nov 2019 16:50:14 GMT

Thanks for the help.

system services firewall policy show:

data:

dns 0.0.0.0/0

ndmp 0.0.0.0/0

ndmps 0.0.0.0/0

portmap 0.0.0.0/0

mgmt:

dns 0.0.0.0/0

http 0.0.0.0/0

https 0.0.0.0/0

ndmp 0.0.0.0/0

ndmps 0.0.0.0/0

ntp 0.0.0.0/0

portmap 0.0.0.0/0

snmp 0.0.0.0/0

ssh 0.0.0.0/0

all under allowed tab

net int show -fields firewall-policy,lif,address

vserver lif address firewall-policy

-------------------------------------------------------

vs-nas mgmt x.x.x.a mgmt

vs-nas nas1 x.x.x.b data

vs-nas nas2 x.x.x.c data

vs-nas nas3 x.x.x.d data

vs-nas nas4 x.x.x.e data

Re: Issue with SSH to nas Vserver

Ontapforrum — Mon, 25 Nov 2019 18:35:22 GMT

Hi,

Thanks for the output.

Looking at the output, looks like there are no restriction from the filer side, all clients are allowed to 'ssh' into cluster-mgnt,node-mgmt and data-lif.

Could you verify the following :

1) Is Windows firewall policy - outbound tcp 22 is denied from where you are trying to ssh?
If so, then you will straight away see - Network error: Access denied.

2) What is the output of the following in your filer:

For example: I am on ONTAP 9.6, if you observe the output below, firewall-policy is 'data' just as in your case, but under services it allows 'management-ssh'. Therefore i am able to ssh to data LIF.

ONTAP96::> network interface show -role data -fields firewall-policy,services
vserver lif services firewall-policy
-------- ------------------ --------------------------------------------------- ---------------
SVM_CIFS SVM_CIFS_cifs_lif1 data-core,data-cifs,management-ssh,management-https data

However, if I remove this 'management-ssh' from service-policy

ONTAP96::> network interface modify -vserver SVM_CIFS -lif SVM_CIFS_cifs_lif1 -service-policy default-data-files

I will get Network error : Access denied.

Could you verify the two points I mentioned.

Re: Issue with SSH to nas Vserver

elic_co — Tue, 26 Nov 2019 15:19:14 GMT

Hey, I was able to figure it out with a little help from a friend as the song says 🙂

It was "system services firewall show"

the firewall was off for nodes 1+2 and on for 3+4

I guess it is because of upgrades from old versions of ontap on nodes 1+2, I also notich these behaviors on other clusters that were upgraded.

I haven't changed it to on yet but i will do it in the next few days and see if it helps

thanks a lot for the help

Re: Issue with SSH to nas Vserver

Ontapforrum — Tue, 26 Nov 2019 16:03:31 GMT

Great, glad to hear that! thanks for the update.