CIFS SVM with 2 LIFs

[Raudi]

Hi,

i have a CIFS SVM with 2 data LIFs in different subnets, they have no connection.

Subnet x is the common client network and subnet y is a dedicated backup network for the backup-server.

Wehen i now watching in the firewall logs, i can see that clients from subnet x want to connect also to the LIF ip in subnet y, which is denied, because the IP isn't accessable.

How can i prevent that the IP from subnet y is reported to clients in subnet x? All communication in subnet x is working normal, all clients are accessing the CIFS SVM without problems.

I'm wondering only about the events in the firewall and searching a way to prevent.

Is there something i can configure?

Kind regards

Stefan

[chamfer]

Hi Stefan,

Is SMB Multichannel enabled? 

Reference: How to check if SMB multichannel is being used - NetApp Knowledge Base

If it is enabled then you should disable it in your scenario.

Reference: Should I enable SMB Multichannel - NetApp Knowledge Base

[FelixZhou]

we have same configuration, two lifs for user access and backup.

we assigned two DNS names to these two interfaces, one used for user access to the shares, second one for backups. each one assigned to a different IP. i don't see any issues.

[Raudi]

Problems we don't see, all is working fine, but i noticed only in the firewall there are denied packets from the client-lan into the backup-lan.

Multichannel isn't enabled, does ist work over different networks?

I think i have the source of the behavior. 

We have CA enabled on one share, this share is for the VHD-files of the users profiles... I remebered that when i enable this and the SVM has only one LIF, i got warnings in the log.

So this can be the reason to trying to connect the 2nd interface.

I have now tryed this command and will watch die result:

system health policy definition modify -node * -monitor node-connect -policy-id NoStandbyLifCifsNdo_Policy -enable false

[Raudi]

Nothing changed, still the same "deny" messages in the firewall.

[Sanaman]

You can try disabling "data-cifs" service in the service-policy associated with the subnet y LIF.

Commands

1. net int show -vserver <CIFS SVM Name> -fields service-policy

2. net int service-policy show   -vserver <CIFS SVM Name> -policy <policy_name from step 1>

3. (In advanced mode) net int service-policy remove-servcie -vserver <CIFS SVM Name> -policy <policy_name from step 1> -service data-cifs