ONTAP SMB/CIFS Deep Dive: Shares, Permissions, Kerberos & SMB 3.x

1. SMB protocol support on ONTAP

ONTAP's CIFS server is a full SMB implementation for both clustered (SVM) and admin SVMs. Supported dialects and defaults matter because Windows clients negotiate down:

• SMB 1.0: disabled by default since ONTAP 9.5 and removed from Windows 10/Server 2019+ clients; ONTAP still allows re-enabling for legacy appliances (vserver cifs options modify -vserver vs1 -is-smb1-enabled true) but you should treat SMB1 as a security risk — WannaCry-class worms spread over it.
• SMB 2.0/2.1: supported for Windows 7/Server 2008 R2-era clients.
• SMB 3.0: Windows 8/Server 2012+: multichannel, SMB encryption, transparent failover on continuously available shares, VSS shadow-copy support via vssadmin against the SVM.
• SMB 3.1.1: Windows 10/Server 2016+: pre-authentication integrity, secure dialect negotiation, AES-128-GCM encryption. This is what modern Windows uses against ONTAP.

ONTAP negotiates the highest common dialect. You can inspect what a client actually negotiated per session with vserver cifs session show -vserver vs1 -instance (look for SMB Dialect and Authentication Mechanism).

2. CIFS server setup & Active Directory join

A CIFS server lives on an SVM and must join the AD domain that hosts the clients. Prerequisites before you start:

• DNS on the SVM resolves the AD domain: vserver services name-service dns create -vserver vs1 -domains ad.example.com -name-servers 10.0.0.10
• An AD user account with rights to create a computer object in the target OU (or a pre-staged machine account).
• Reachability to the domain controllers: vserver services name-service dns check -vserver vs1 -node node1 and vserver cifs domain discovered-servers show -vserver vs1.

vserver cifs create -vserver vs1 -cifs-server-name VS1CIFS \
  -domain ad.example.com -admin-user AD\svc_ontap

# verify the join state
vserver cifs show -vserver vs1 -instance
#   CIFS Server Name: VS1CIFS
#   Domain: AD.EXAMPLE.COM
#   Administrative Status: up

# if the machine account was pre-staged, skip the join with -skip-root-creation
vserver cifs create -vserver vs1 -cifs-server-name VS1CIFS \
  -domain ad.example.com -skip-root-creation true

The join creates a machine account, registers an SPN (service principal name) for the CIFS server, and sets up the secure channel. From ONTAP 9.10.1 the default AES Kerberos armoring (FAST) is used when the domain supports it; check with vserver cifs security show -vserver vs1.

3. Share management

A share is the network-visible entry point mapped to a path in the SVM's namespace. Shares are created per SVM, and their ACLs are evaluated before NTFS ACLs.

vserver cifs share create -vserver vs1 -share-name data \
  -path /data -share-properties oplocks,browsable \
  -symlink-properties symlinks -comment "Team data"

# show effective share settings
vserver cifs share show -vserver vs1 -share-name data -instance

# modify on the fly (add continuously-available, remove browsable)
vserver cifs share modify -vserver vs1 -share-name data \
  -share-properties oplocks,continuously-available

# share-level ACL: grant a group, then remove the default Everyone
vserver cifs share access-control list -vserver vs1 -share-name data \
  -user-or-group "AD\StorageTeam" -permission change
vserver cifs share access-control delete -vserver vs1 -share-name data \
  -user-or-group Everyone

Share properties that matter: oplocks (client caching, default on), browsable (visible in Explorer), continuously-available (SMB 3 transparent failover, required for Hyper-V/SQL over SMB), show-snapshot (exposes ~snapshot dirs), access-based-enumeration (hide files the user cannot read — great for home dirs and compliance), ca-vsa (VSS for continuously available shares).

Deleting a share never deletes data — it only removes the network path. Renaming with vserver cifs share rename preserves the ACL.

4. Permissions: share ACLs, NTFS ACLs & security styles

Access to a file over SMB requires both the share ACL and the NTFS ACL to allow. The effective permission is the intersection. ONTAP enforces NTFS ACLs itself (it is an NTFS ACL enforcer, not just a passthrough), so no Samba-style mapping loss occurs.

Security styles

Each volume has a security style that decides whose ACL rules:

• NTFS — ONTAP stores and enforces Windows ACLs on every file/dir. Best for pure Windows workloads.
• UNIX — POSIX mode bits; SMB clients are mapped to Unix users/groups. Use for mixed NFS/SMB access where Unix identity rules.
• Mixed — both ACL types apply per-file, based on the last writer. Powerful but the #1 source of "permissions are wrong" tickets; avoid unless a migration demands it.

volume show -vserver vs1 -volume data -fields security-style,unix-permissions
volume modify -vserver vs1 -volume data -security-style ntfs

# for UNIX/Mixed volumes, set the default Unix user for SMB-authenticated users
vserver cifs security modify -vserver vs1 -default-unix-user nobody

NTFS ACL management from ONTAP

You can set NTFS ACLs from the CLI or via Windows icacls over the share. From the CLI (ONTAP 9.x):

vserver security file-directory create -vserver vs1 \
  -path /data/projects -user-or-group "AD\StorageTeam" \
  -permission full_control -apply-to files,sub_folders,this_folder

# remove a permission entry
vserver security file-directory delete -vserver vs1 \
  -path /data/projects -user-or-group "AD\Contractors"

# show effective permissions for a user (what they can actually do)
vserver security file-directory show -vserver vs1 -path /data/projects \
  -effective-permissions -user-or-group "AD\bob"

Troubleshooting permission denials: run a security trace to see exactly which ACL entry denied access and at which layer (share vs NTFS):

vserver security trace start -vserver vs1 \
  -path /data -user-or-group "AD\bob" -trace-duration 10m
# reproduce the access from the client, then:
vserver security trace file show -vserver vs1
vserver security trace file delete -vserver vs1 -file *

5. Authentication: Kerberos & NTLM

ONTAP authenticates SMB sessions against AD: Kerberos by default for domain users, NTLMv2 as fallback for non-domain or legacy cases. Details that bite:

• SPN: the CIFS server's machine account registers cifs/VS1CIFS.ad.example.com. If AD has duplicate SPNs, Kerberos breaks while NTLM still works — check with setspn -L VS1CIFS from a domain host.
• Clock skew: Kerberos tolerates ~5 minutes. Keep cluster nodes NTP-synced: cluster time-service ntp server show.
• NTLMv1 vs v2: NTLMv1 is a pass-the-hash risk; ONTAP allows restricting it. Use vserver cifs security modify -vserver vs1 -is-ntlmv1-enabled false (requires all clients to support NTLMv2/Kerberos).
• Signing & sealing: -is-signing-required true and -is-aes-encryption-enabled true on the CIFS security object force SMB signing and AES. Signing costs ~5-10% throughput on SMB3; it is on by default for SMB 3.0+ sessions.
• Anonymous access: -is-anonymous-access-enabled false (default) prevents unauthenticated enum of shares.

vserver cifs security show -vserver vs1 -instance
#   Kerberos Clock Skew: 5
#   Is Signing Required: true
#   Is NTLMv1 Enabled: false
#   Is AES Encryption Enabled: true

# diagnose domain/KDC reachability
vserver cifs domain discovered-servers show -vserver vs1
vserver cifs domain preferred-dc show -vserver vs1
vserver cifs session show -vserver vs1 -instance | grep -iE "auth|kerberos"

6. SMB 3.x features on ONTAP

SMB Multichannel

Enabled by default: a client with multiple NICs (or RDMA) opens multiple TCP connections per session, aggregating throughput and providing NIC failover. Verify with vserver cifs session show -fields remote-address,connection-count — a multichannel session shows several connections. No configuration needed; just ensure the client can reach multiple LIFs (same IPspace) on the same subnet.

SMB Direct (RDMA)

ONTAP supports SMB Direct over RoCE/InfiniBand on supported hardware (AFF A-Series with RDMA NICs, and via network interface on RDMA-capable ports). It bypasses the TCP stack for zero-copy transfers — the single biggest Windows throughput win for large files.

SMB Encryption

Per-SVM or per-share encryption of the SMB payload (AES-128-CCM/GCM). Per-share is finer-grained:

# whole SVM
vserver cifs security modify -vserver vs1 -is-smb-encryption-required true
# per share (ONTAP 9.10+)
vserver cifs share modify -vserver vs1 -share-name sensitive \
  -is-encryption-required true

Continuously Available (CA) shares & transparent failover

CA shares survive node failover without client reconnect — required for Hyper-V and SQL Server over SMB. The share needs continuously-available property and the SVM needs the CA license enabled:

system license add -license-code XXXXX   # CA license (usually bundled with NFS)
vserver cifs options modify -vserver vs1 -is-ca-vsa-enabled true
vserver cifs share modify -vserver vs1 -share-name vmstore \
  -share-properties continuously-available,oplocks

During a takeover/giveback, CA sessions are held open and resumed (SMB 3 persistent handles). Non-CA sessions are dropped — plan client reconnect behavior for ordinary file shares.

SMB over QUIC

ONTAP 9.16.1+ can serve SMB over QUIC/TLS on UDP 443, giving VPN-free remote access. Covered in depth in SMB over QUIC on ONTAP.

7. Home directories & user mapping

Home-directory shares let every AD user get \server\users\<name> without a share per user. ONTAP resolves the user and maps to /home/<sam-name> (or upn style):

vserver cifs home-directory search-path add -vserver vs1 -path /home
vserver cifs share create -vserver vs1 -share-name users \
  -path /home -share-properties oplocks,browsable,home-directory,access-based-enumeration

# user mapping for non-domain / mixed environments
vserver name-mapping create -vserver vs1 -direction win-unix \
  -pattern "AD\\(.*)" -replacement "\\1"

access-based-enumeration hides other users' home folders — without it, every user sees every home directory name.

8. Performance & tuning

• Oplocks: keep enabled (default). Disabling them (e.g. for some backup apps) tanks throughput by forcing round-trips per operation.
• SMB signing: required by default on SMB 3.0+; it is negotiated automatically. If you see heavy CPU on clients with very high IOPS, check whether sealing (-is-seal-required) was forced — it is more expensive than signing.
• Directory caching: ONTAP caches directory enumerations server-side; large dir /s-style scans are fast. Disable -is-dir-cache-enabled only when debugging stale-listing reports (then re-enable!).
• Max connections per session: vserver cifs options modify -vserver vs1 -max-connections-per-session 32 for multichannel headroom on 100GbE clients.
• Write performance: SMB 3.1.1 with AES-GCM and multichannel typically saturates 10/25GbE; if a single client is slow, check the client NIC/offload and RDMA availability before blaming ONTAP.
• QoS: apply qos policy-group to the volume or file to protect other workloads from a chatty Windows backup share.

9. Monitoring & operational commands

vserver cifs session show -vserver vs1                     # who is connected
vserver cifs session show -vserver vs1 -instance           # dialect + auth details
vserver cifs openfiles show -vserver vs1                   # what files are open
vserver cifs openfiles close -vserver vs1 -file-id 12345   # force close a stuck handle

# per-SVM audit of SMB access (file + security events)
vserver audit create -vserver vs1 -destination /audit \
  -events file-ops,security -format evtx
vserver audit show -vserver vs1

# counters
statistics show -vserver vs1 -object cifs -counter * -sample-id 1

Audit events land as EVTX on the SVM's audit volume and can be forwarded to a Windows collector — see ONTAP Audit & Event Logging for the full pipeline.

10. Troubleshooting matrix

For step-by-step diagnosis of the most common SMB issues, see the SMB/CIFS troubleshooting runbook.

11. SMB vs NFS on ONTAP: quick comparison

Most SVMs serve both protocols on the same volumes — the choice is usually client-driven. See NFS vs SMB vs S3 vs iSCSI vs FC vs NVMe for the full decision guide.