Storage Admin HubConfiguration · Protection · Recovery
All guides/Troubleshooting
Troubleshooting · ONTAP 9

NFS or SMB client cannot access data

Trace name, network, protocol, export/share, and identity in order.

Scenario

Example: a Linux host can ping the data LIF but gets NFS access denied. This is an authorization or path problem until evidence shows otherwise.

Before you change production

Commands and screens can differ by release and platform. Replace example names and documentation IP addresses. Check prerequisites, impact, current health and rollback with your change owner.

1. Scope the symptom

  1. Record client address, user identity, SVM/data LIF, exact path/share, protocol version, error text, first failure time, and whether other clients work.
  2. Resolve the name from the client and connect to the data LIF. If connection times out, inspect VLAN, route, firewall, port and LIF. If connection succeeds but access is denied, inspect policy and identity.
Read-only network checks 
network interface show
network route show
event log show -severity ERROR

2. NFS branch

  1. Confirm the junction path is mounted and each parent path can be traversed. Inspect export policy on the volume and rule order, client match, protocol, read/write security, superuser treatment, and UNIX ownership.
  2. Test a single authorized client using the exact LIF and path. Do not broaden the rule to all clients merely as a diagnostic.
Read-only NFS checks 
vserver nfs show
volume show -fields junction-path,policy
vserver export-policy rule show

3. SMB branch

  1. Confirm the SMB server is joined to AD, DNS and time are healthy, and the share points to the expected volume path.
  2. Inspect share permissions and file-system ACLs with the user token and group memberships. Test another known-good user to isolate identity versus share-wide failure.
Read-only SMB checks 
vserver cifs show
vserver cifs share show
Verify

The root cause is tied to one layer and access is retested with the original user.

If validation fails

  1. When only one client fails, compare its DNS answer, route, IP, mount options or SMB identity with a working client.
  2. When all clients fail simultaneously, prioritize shared dependencies: data LIF, switch, SVM protocol service, DNS/AD and volume state.
  3. When reads work but writes fail, distinguish export or share permissions from file-system ACLs, UNIX mode bits and volume read-only state.
Verify

Re-run the original validation and record the observed result, exact error, time, and corrective action.

NetApp references