Netapp share IP not responsive but netapp name is connected.

[Conankenan]

Hi,

I have netapp 2520 storage and this storage use nas for our systems.

- \\netappname\shared folder connected

but 

- \\netappIP\shared folder not access 

What can I do ?

Dns system check not problem and reverse is working.

Thanks

[pedro_rocha]

hello

what is the error being shown with the IP attempt?

[Conankenan]

This error access denided. Look please attachment

and when I write try with IP adress on share this message on active directory.

same time look active directory event viewer;

The Netlogon service denied a vulnerable Netlogon secure channel connection from a machine account.

Machine SamAccountName: mrkznas
Domain: xxx.local.
Account Type: Domain Member
Machine Operating System: OnTap
Machine Operating System Build: 8.1.2P4
Machine Operating System Service Pack: N/A

For more information about why this was denied, please visit https://go.microsoft.com/fwlink/?linkid=2133485.

[Conankenan]

Netapp on puty terminal message;

[mrkznas:auth.tace.authanticateUser.Login.Rejected:info] AUTH:Login attemt by user rejected by the domain controller with error 0x0000022:STATUS_ACCESS_DENIDED.

[pedro_rocha]

Hello,

There is a KB: https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/Microsoft_Security_Advisory%3A_CVE-2020-1472_impact_on_NetApp_applianc...

Apparently this is your case:

• 7-Mode supports Netlogon Secure Channel on fixed releases (8.2.5P5 7-Mode)
• Review the details in 1343982: Support Netlogon Secure Channel in 7-mode for CVE-2020-1472
  • Workaround 1: NetApp recommendation is to upgrade to 8.2.5P5
    • A new option was introduced to enable support for secure netlogon (cifs.netlogon.secure_channel.enable)
    • This option is vfiler scoped. It must be enabled on all vfilers involved in domain authentication
  • Workaround 2: Microsoft has a workaround to allow vulnerable netlogon secure connections via GPO
• For more information, contact Netapp Technical Support

I guess you gotta go with workaround 2. I believe this system does not have support and running an upgrade would be risky.

Regards,

Pedro

[Conankenan]

Thank for reply,

Problem is not solition. Can any help me with remote ?

I cant understand problem, what happend system.

Shane name is ok but share IP nothing answer.  What should do this system?

[pedro_rocha]

Sorry I did not get what you mean to say.

I think you should follow the Microsoft workaround: https://support.microsoft.com/en-us/topic/how-to-manage-the-changes-in-netlogon-secure-channel-connections-associated-with-cve-2020-1472-f7e8cc17-0309...

[Conankenan]

Sorry little english,

Can you help with remote connection my system ?

[pedro_rocha]

Hello my friend,

Sorry I won't be able to do that. But try to find this security policy on your windows machine/GPO:

You got to ALLOW the setting (this will make your environment susceptible to security risks). If your system is 7-mode, this appears to be the only option. If you are running ONTAP and have a support contact, open a case with NetApp. IF you don't have a support contract, then you should stick with the workaround that I mentioned.

Regards,

Pedro

[Conankenan]

Thanks,

I trayed 7 mode but nothing.  I am searching solition thanks.

[pedro_rocha]

Did you try the workaround?

It's on Windows.

[Conankenan]

yes I tryed. But nothing any.

interesting;

All network share any server I connected.(IP and Share name connect)

but just netapp shares with IP not connect.  (we have 3 Netapp device two 2040 one 2520) all netapp devices share IP not opened but share name with connect

Please Look Attachment

[pedro_rocha]

what is the ONTAP version?

[Conankenan]

Sent to attachments

[Conankenan]

When I connect with IP.  SSH netapp terminal get error this. look attachment.