In NetApp ONTAP, client access to Network Attached Storage (NAS) file resources over the Network File System (NFS) protocol is strictly governed by export policies and their associated export rules. An export policy functions as a network firewall and authorization gatekeeper between the client IP network and the ONTAP storage namespace.
When a new Storage Virtual Machine (SVM) and a new FlexVol volume are created, client mount requests will be rejected by default unless the volume is associated with an export policy containing a matching export rule. The export policy rule defines:
The client match criteria (specific IP address, subnet CIDR, or hostname domain).
The allowed NFS protocol versions (NFSv3, NFSv4.0, NFSv4.1).
The access permissions granted (read-only, read-write, or superuser/root access).
Security flavor requirements (sys/AUTH_SYS, krb5, krb5i, krb5p).
Without an explicit export policy rule matching the NFS client's IP address, the ONTAP storage node returns an "Access Denied" or "Permission Denied" RPC mount error. A qtree is an optional subdirectory boundary used for quotas. POSIX ACLs control file-level permissions within the filesystem after the mount succeeds, and initiator groups (igroups) are used strictly for SAN block protocols (iSCSI/FC).
[Reference: NetApp Data Administrator, ONTAP – Storage Protocols and Connectivity; NFS File Access Management; Configuring Export Policies and Rules in ONTAP 9., , ===============, ]
Submit