ONTAP System Manager IP Limiting

JamieTalbot — Wed, 04 Jun 2025 10:43:15 GMT

Hi,

I am wondering if it is possible to block all access to the NetApp ONTAP System Manager web console on port 80/443 unless you have a specific IP address?

I want to only allow staff within our IT department to be able to connect to the web console and only from their own computers with fixed IP addresses.

Best Regards

Jamie

Re: ONTAP System Manager IP Limiting

WAFLHERDER — Wed, 02 Dec 2020 15:46:56 GMT

Hi Jamie,

If I understand the question correctly, you should be able to block access to the System Manager Web server with firewall rules in ONTAP itself.

Prior to ONTAP 9.5 (or so), these were called "Firewall Policies". On the CLI you use "system services firewall policy ...".

In newer releases they are termed "LIF Service Policies" and are accessed via "network interface service-policy ...".

Obviously those are configured per LIF. You would need to add a new policy for the admin and node vservers of the cluster.

Status of the firewall itself can be seen with "system services firewall show". I think by default it is normally on, but does not do any logging (thats's what I see here, on a ONTAP 9.7 system). It might be useful to enable logging for testing or longer term for analytics/correlation/intrusion detection.

Given the nature of your question, you may also want to think about how to limit access to the Service Processor, typically a physically separate piece of hardware, accessed via a URI ending in ".../spi/", which can give access to the system logs, for example. But I am not sure if that can also be done via this same mechanism ...

Hope this helps.

Cheers,

Robb.

Re: ONTAP System Manager IP Limiting

Mjizzini — Tue, 15 Dec 2020 08:17:32 GMT

One idea will be to separate the management from data network. you can create a management vlan for them.

topic ONTAP System Manager IP Limiting in ONTAP Discussions

ONTAP System Manager IP Limiting

Re: ONTAP System Manager IP Limiting

Re: ONTAP System Manager IP Limiting