Wednesday, May 15, 2019

Standardize fixed TCP/UDP port selection for NFS firewalling?

NFSv4 and later has (a) fixed TCP/UDP port for communication; NFSv3 and earlier use dynamic ports discovered through the ONC RPC portmapper on udp/111.

Windows Server supports serving NFS 4.1, but as a client still only supports NFSv3, so I need to support the traditional ONC RPC ports. As we all remember, these are normally dynamic and play havoc with firewalls, which don't have ALGs for ONC RPC, and with NAT, for those situations where it must be used. Luckily, the ports can be fixed to well-known ports in modern implementations.

Most Linux distro documentation uses some ports in the 32000 range, but NetApp's default fixed ports are notably different as are Isilon's.

service NetApp Clustered Data ONTAP Netapp Data ONTAP 7 Mode Isilon
portmapper 111 111 111
nfs 2049 2049 2049
mountd NFSv3 635 4046 300
statd NFSv3 4046 4047 302
lockd 4045 4045 304

I'm interested to know if you standardize these in your environment, what standards you use, and if there might be anything any more authoritative on what the standard should be.



No comments:

Post a Comment