NFS mount issue in C-mode

[raovolvoadmin]

Hello eveyone,

I have created the Unix volume and exported to all unix client which are in the 72 subnet.

I have created the LIF on the Vserver and Ip assigned to LIF Is 192.168.72.XXX

From the Clinet(Linux Sever) which are exist in the same subnet,I m trying to mount the share which is exported from the Vserver.But i m getting below error.If any one knows about this issue.Plz help me..

[root@stglinux02 ~]# mount  192.168.72.117:/nfs /mnt

mount.nfs: access denied by server while mounting 192.168.72.117:/nfs

/nfs is the Junction-path.

Rules in the export policy is:

Clu1::> vserver  export-policy rule show -vserver DataServe02 -policyname NfsPolicy

             Policy          Rule    Access   Client                RO

Vserver      Name            Index   Protocol Match                 Rule

------------ --------------- ------  -------- --------------------- ---------

DataServe02  NfsPolicy       1       any      192.168.72.0/255.255.255.0  any

Thanks in advace..

Regards

Rao.

[scottgelb]

Is the volume using that nfs policy or the default policy. You may need to vol modify to use this policy.

Sent from my iPhone 5

[raovolvoadmin]

I am not using the default policy.

I have created the policy("NfsPolicy").

Regards

Rao.

[scottgelb]

What is the output of "vol show -inst"

Sent from my iPhone 5

[raovolvoadmin]

Hi Gelb,

find the output below...

Clu1::> vol show -volume NFSvol  -instance
  (volume show)

                                 Vserver Name: DataServe02
                                  Volume Name: NFSvol
                               Aggregate Name: aggr2
                                  Volume Size: 500MB
                           Volume Data Set ID: 1039
                    Volume Master Data Set ID: 2147484687
                                 Volume State: online
                                  Volume Type: RW
                                 Volume Style: flex
                       Is Cluster-Mode Volume: true
                        Is Constituent Volume: false
                                Export Policy: NfsPolicy
                                      User ID: 0
                                     Group ID: 1
                               Security Style: unix
                             UNIX Permissions: ---rwxr-xr-x
                                Junction Path: /nfs
                         Junction Path Source: RW_volume
                              Junction Active: true
                       Junction Parent Volume: vol0
                                      Comment:
                               Available Size: 474.9MB
                              Filesystem Size: 500MB
                      Total User-Visible Size: 475MB
                                    Used Size: 144KB
                              Used Percentage: 5%
         Volume Nearly Full Threshold Percent: 95%
                Volume Full Threshold Percent: 98%
         Maximum Autosize (for flexvols only): 600MB
       Autosize Increment (for flexvols only): 25MB
                             Minimum Autosize: 500MB
           Autosize Grow Threshold Percentage: 85%
         Autosize Shrink Threshold Percentage: 50%
                                Autosize Mode: off
         Autosize Enabled (for flexvols only): false
          Total Files (for user-visible data): 15182
           Files Used (for user-visible data): 96
                        Space Guarantee Style: file
                    Space Guarantee in Effect: true
            Snapshot Directory Access Enabled: true
                 Space Reserved for Snapshots: 5%
                        Snapshot Reserve Used: 3%
                              Snapshot Policy: default
  Creation Time: Sat Jul 13 13:02:09 2013

                                 Clone Volume: false

                   Antivirus On-Access Policy: default

                                    Node name: Clu1-02

                                NVFAIL Option: off

                    Is File System Size Fixed: false

                                Extent Option: off

                Reserved Space for Overwrites: 0B

                           Fractional Reserve: 100%

                  Snapshot Cloning Dependency: off

            Primary Space Management Strategy: volume_grow

                     Read Reallocation Option: off

             Inconsistency in the File System: false

                 Is Volume Quiesced (On-Disk): false

               Is Volume Quiesced (In-Memory): false

    Volume Contains Shared or Compressed Data: false

            Space Saved by Storage Efficiency: 0B

       Percentage Saved by Storage Efficiency: 0%

                 Space Saved by Deduplication: 0B

            Percentage Saved by Deduplication: 0%

                Space Shared by Deduplication: 0B

                   Space Saved by Compression: 0B

        Percentage Space Saved by Compression: 0%

                                   Block Type: 64-bit

                  FlexCache Connection Status: -

                             Is Volume Moving: false

               Flash Pool Caching Eligibility: read-write

Flash Pool Write Caching Ineligibility Reason: -

                   Managed By Storage Service: -

Create Namespace Mirror Constituents For SnapDiff Use: -

                      Constituent Volume Role: -

                        QoS Policy Group Name: -

              Is Volume Move in Cutover Phase: false

      Number of Snapshot Copies in the Volume: 9

[scottgelb]

Does the parent volume / ...the vsroot volume have permission to traverse this mount path at vol0?

Also if ls mirrors of vsroot and you add a volume junction it won't be available until a snapmirror update since the mirror of the namespace doesn't have the new junction yet.

I also would run showmount -e ipofvserver from the Linux client.

Sent from my iPhone 5

[parisi]

A few things...

1) Showmount -e won't work. It doesn't work in cDOT yet, so don't be surprised when you get "/ everyone" as output.

2) The export policy rule client match might be incorrect. I don't think the format  you have it in is correct. Pretty sure you have to specify subnet in network bit. Try this instead:

192.168.72.0/24

http://www.pantz.org/software/tcpip/subnetchart.html

3) I don't think volume permissions have anything to do with this. The error is at mount, which means it's checking export policy rules for access to mount. If the error was access denied after mounting, then it might be vol permissions. However, it *could* possibly be an export policy rule problem at the parent volume. Check the vsroot export policy and ensure rules exist there.

4) I also don't think LS mirrors are the issue. If the issue was with a volume not showing up in the namespace, the error would be "file not found" or something similar.

Permission errors on mount are almost always export policy rule issues.

[raovolvoadmin]

Thanks Guys,It worked now.

I have applied the Export policy(NfsPolicy ) on the Root volume(vol0).Now i m able to mount from the client.

Regards

Rao.

Storageteam.  

[MPERIYAK]

Actually there is no need to apply the policy to the root volume at all. Did you try my other command. let me know.

[okieunixsam1]

Can you show me how you did the export policy on vol0?

Thanks

[scottgelb]

Forget the showmount 🙂 didn't notice it reported everyone can mount until now. Fixed in a future 8.2 release or later into 8.3?

[MPERIYAK]

what is the output of the command show -instance NfsPolicy

Also try this - export-policy rule create -vserver DataServe02 -policyname NfsPolicy -clientmatch 192.168.72.0/24 -protocol nfs -rorule sys -rwrule sys -superuser sys

[raovolvoadmin]

Hi Murugappan,

Clu1::> export-policy  rule create -vserver DataServe02 -policyname NfsPolicy  -clientmatch 192.168.72.0/24  -protocol nfs -rorule  sys -rwrule sys -superuser  sys
  (vserver export-policy rule create)

Clu1::> export-policy show -vserver DataServe02 -policyname NfsPolicy -instance                                                                                (vserver export-policy show)

    Vserver: DataServe02
Policy Name: NfsPolicy

removed the NfsPolicy from the Vol0.

Now again i m getting below error.

[root@stglinux02 ~]# mount 192.168.72.117:/nfs /clunfs

mount.nfs: access denied by server while mounting 192.168.72.117:/nfs

[parisi]

The behavior of parent volumes/export policy rules depends on the version of clustered Data ONTAP being used. In 8.2, export policies do apply at the parent volume level and affect child permissions.

Example:

::*> export-policy create -vserver nfs -policyname empty

  (vserver export-policy create)

::*> vol modify -vserver nfs -policy empty -volume nfs_root

  (volume modify)

Volume modify successful on volume: nfs_root

[root@centos64 ~]# mount -o nfsvers=3 10.61.92.40:/unix /mnt

mount.nfs: access denied by server while mounting 10.61.92.40:/unix

::*> vol modify -vserver nfs -policy default -volume nfs_root

  (volume modify)

Volume modify successful on volume: nfs_root

[root@centos64 ~]# mount -o nfsvers=3 10.61.92.40:/unix /mnt

[root@centos64 ~]#

This behavior changed around 8.1 with bug 429128.

http://support.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=429128

[parisi]

I filed an RFE today to add the policy inheritance option to volumes.

[scottgelb]

Nice. So me volumes won't have to be modified after creation?

[raovolvoadmin]

Thanks guys for you help:-)

[NAVEENKL22]

Hi Raovolvoadmin,

I think you made a mistake while you are creating default polocy. Please check it. For -Clientmatch option in your default polocy you forgot to mention subnet. Thats why it is causing the issue.

Please keep it as 0.0.0.0/0 instead of 0.0.0.0

You don't need to change the polocy of the root volume from default to any .....

I think it will help you.

[acannan]

I have the same issue here guys... I need your  help 🙂 

[root@usvjicap01 ~]# umount /NEWUPLOAD
[root@usvjicap01 ~]# mount -v -o vers=4 st-jh-nas-svm01:/vol077_nfs/PRDUpload /NEWUPLOAD
mount: no type was given - I'll assume nfs because of the colon
mount.nfs: timeout set for Fri Jan 29 14:55:43 2016
mount.nfs: trying text-based options 'vers=4,addr=172.22.71.213,clientaddr=172.22.100.152'
mount.nfs: mount(2): Permission denied
mount.nfs: access denied by server while mounting st-jh-nas-svm01:/vol077_nfs/PRDUpload
[root@usvjicap01 ~]# mount -v -o vers=3 st-jh-nas-svm01:/vol077_nfs/PRDUpload /NEWUPLOAD
mount: no type was given - I'll assume nfs because of the colon
mount.nfs: timeout set for Fri Jan 29 14:55:56 2016
mount.nfs: trying text-based options 'vers=3,addr=172.22.71.212'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: trying 172.22.71.212 prog 100003 vers 3 prot TCP port 2049
mount.nfs: prog 100005, trying vers=3, prot=17
mount.nfs: trying 172.22.71.212 prog 100005 vers 3 prot UDP port 635
st-jh-nas-svm01:/vol077_nfs/PRDUpload on /NEWUPLOAD type nfs (rw,vers=3)

[ECARRILLOJR]

You have either set your default policy to allow everything 0.0.0.0/24 and make sure all permissions are set or use your default policy for access to your NFS clients.  The default rule acts as a gateway ACL for lack of better terms.  

[ECARRILLOJR]

You have either set your default policy to allow everything 0.0.0.0/24 and make sure all permissions are set or use your default policy for access to your NFS clients.  The default rule acts as a gateway ACL for lack of better terms.