F5 ARX-VE, Planning Manual

Page: 38 / 64

Chapter 1
Site Planning
1 - 32
Planning for a Multi-Protocol Namespace
A multi-protocol namespace supports both NFS and CIFS. You can use it
with a heterogeneous set of back-end filers with multi-protocol shares.
Currently-supported filer vendors include NetApp and EMC.
The ARX passes NFS and/or CIFS operations through to the back-end
shares, which permit or deny the operations based on client identity and
file/directory permissions. Each filer permits or denies access to files based
on its own rules, and the ARX passes back the response back to the client.
Important
This has far-reaching implications for client access in a heterogeneous
volume. If you mix multi-protocol shares from multiple vendors in the same
volume, client access can change when files migrate from one filer to
another. This is an unavoidable consequence of different multi-protocol
implementations from the filer vendors.
Consult your filer documentation (from all vendors) concerning client
access and the recommended security configurations. Pay particular
attention to
non-native access to the filer. Non-native access means
accessing a UNIX file through CIFS, or an NTFS (Windows) file through
NFS. Of particular interest are the following questions:
◆
How will the client’s identity (UID/GID in UNIX, owner SID and
primary-group SID in NTFS) be interpreted in the file’s environment?
◆
Is the client’s access restricted in unexpected ways (for example, can an
NFS client delete NTFS files in a directory where they apparently have
UNIX write and execute permissions)?
◆
Is the client allowed to change permissions on the non-native file? If so,
how are the new permissions interpreted in the file’s environment?
Our best practice is to use NTFS Qtrees for NetApp filers whenever you mix
them with EMC file servers. The following subsections discuss specific best
practices for various vendors.
NetApp Best Practices
Client Identity
A NetApp filer maps UNIX usernames to NT usernames. If a client has the
same username for both operating systems, the mapping is straightforward.
For clients with different usernames in each environment, you can configure
a map on the NetApp, /etc/usermap.cfg. After the NetApp maps the
username, it consults the operating system to find the user’s Group ID (in
UNIX) or primary-group SID (in NT).