NetApp ONTAP NFS Export Policy Configuration (CLI)

On NetApp ONTAP, every NFS volume export is governed by an export policy: a named collection of rules that decide which clients may mount the volume, from which IP ranges, and with what read/write/root privileges. Export policies sit between the SVM and the FlexVol, and getting them wrong is the most common reason a new NFS datastore or home directory mount fails with "permission denied" or "access denied by server". This article walks through creating an export policy, adding rules and attaching it to a volume with the ONTAP CLI.

Before You Start

Confirm the SVM exists and NFS is enabled on it (NFSv3/NFSv4 is enabled by default when the SVM is created for NAS, but verify with vserver nfs status). You also need a FlexVol to attach the policy to.

Create the Export Policy

vserver export-policy create -vserver vs1 -policyname nfs_policy

Policy names can be up to 256 characters. Every SVM has a default policy named default that allows no access — an explicit policy plus rules is required before any client can mount.

Add Rules to the Policy

A rule defines which clients match and what they may do. The example below lets hosts in 10.10.10.0/24 mount with read-write access, while the storage admin subnet 192.168.1.0/24 additionally gets superuser (root) access:

vserver export-policy rule create -vserver vs1 -policyname nfs_policy -ruleindex 1   -protocol nfs -clientmatch "10.10.10.0/24" -rorule sys,krb5 -rwrule sys,krb5 -superuser none
vserver export-policy rule create -vserver vs1 -policyname nfs_policy -ruleindex 2   -protocol nfs -clientmatch "192.168.1.0/24" -rorule sys -rwrule sys -superuser sys

Key rule parameters: -clientmatch accepts IP addresses, CIDR prefixes, netgroups (prefixed with @) or domain names; -rorule/-rwrule control read and read-write access with values sys (AUTH_SYS), krb5, krb5i, krb5p or none; -superuser decides whether root on the client maps to root (or an anonymous user) on the volume. Rules are evaluated in ruleindex order and the first match wins, so put specific ranges before broad ones.

Assign the Policy to a Volume

volume modify -vserver vs1 -volume vol1 -policy nfs_policy
volume show -vserver vs1 -volume vol1 -fields policy

The same policy can be shared by many volumes. If a volume currently has no policy assigned, ONTAP applies the SVM default policy (no access) — always assign a policy explicitly when you create the volume.

Verification and Common Failures

vserver export-policy rule show -vserver vs1 -policyname nfs_policy
vserver export-policy check-export -vserver vs1 -path /vol1 -client 10.10.10.50
vserver nfs status

export-policy check-export is the fastest way to see which rule would apply to a given client. Typical mount failures trace to: no rule matching the client subnet, -superuser none blocking root mounts, NFS disabled on the SVM, or a junction-path mistake in the mount string. If name resolution is involved, check the name-service configuration (LDAP/NSDB) — our ONTAP network configuration best practices article covers the LIF and routing prerequisites, and ONTAP SnapMirror shows the CLI style for the rest of the data-protection stack.

原文链接：https://docs.netapp.com/us-en/ontap/nfs-config/create-export-policy-task.html