Excellent! I might have led you astray with that "change the hostname" thing in SnapProtect - I think that is for setting up the control connection to the filer, and then the filer initiates a connection back to the DMA (SnapProtect) according to that "-preferred-interface-role" setting you mentioned.
Here's the relevant part of the cdot commands doco (for the benefit of anyone else who comes here with the same issue) :
Command: vserver servervices ndmp modify [-preferred-interface-role {cluster|data|node-mgmt|intercluster|cluster-mgmt}, ...] -
Preferred Interface Role
This option allows the user to specify the preferred Logical Interface (LIF) role while establishing an NDMP data connection channel. The NDMP data server or the NDMP mover establishes a data channel from the node that owns the volume or the tape device respectively. This option is used on the node that owns the volume or the tape device. The order of IP addresses that are used to establish the data connection depends on the order of LIF roles specified in this option.
The default value for this option for the admin Vserver is intercluster, cluster-mgmt, node-mgmt
The default value for this option for a data Vserver is intercluster, data.
^^ reading this above (my bold) I think SnapProtect must have been connecting to the cluster management LIF, otherwise by default, ONTAP wouldn't have tried to use the node management LIF. If you change that hostname setting to be a management LIF on your data vserver, it would probably only have been able to use the intercluster or data port.
Anyway I'm glad you fixed it. I'm still getting my head around the CAB extensions myself, and SnapProtect is never quite as straightforward as I'd like 🙂 10GbE is way faster than 100Mb, right? 😉