Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

DFS Failover Advanced Configuration

Introduction​

This article covers two advanced DFS Failover configuration scenarios that go beyond the base setup described in DFS Configuration Procedures: combining DFS-enabled SyncIQ policies with Access Zone Failover in the same Access Zone, and configuring non-Windows (Linux/Samba) clients to mount DFS namespaces.

Combining DFS Type with Access Zone Failover​

If you are using DFS-type policies inside an Access Zone that also has other policies using Access Zone Failover, additional configuration is required. This ensures the SmartConnect Zones used for DFS folder UNC paths are not failed over with the rest of the Access Zone and do not require their own Eyeglass hints for zone readiness.

Configuration Steps​

  1. Create a dedicated IP pool for DFS-protected data and make the IP pool a member of the Access Zone.

  2. Create the SMB shares for the DFS UNC paths.

  3. Create the SyncIQ policy that will protect the DFS shares.

  4. Discover the policy with Eyeglass and edit the job in the Jobs Definition window to enable DFS type.

    Run the DFS-type job in Eyeglass to confirm it completes successfully.

  5. Create an Eyeglass hint to make Eyeglass ignore the dedicated DFS IP pool during Access Zone Failover readiness calculations, using an IP pool alias named igls-ignore.

  6. Create the same hint on both the source and target cluster's dedicated DFS IP pool.

  7. Run the Zone Readiness job (or use Run Now) to update the DR Dashboard. The dedicated DFS IP pool should be excluded from the Access Zone's readiness calculation, while the rest of the Access Zone's IP pools continue to be tracked normally.

info

Without the igls-ignore hint, Eyeglass will attempt to include the DFS-dedicated IP pool in Access Zone Failover readiness and execution, which is not the intended behavior since the DFS SmartConnect Zone and pool are already failed over independently by the DFS SyncIQ policy job.

NFS Exports Under a DFS-Type Policy​

Microsoft DFS type is a Windows/SMB mechanism, so it does not automatically redirect NFS clients. If the same SyncIQ policy that is enabled for DFS type also protects NFS exports, plan for the NFS side of that policy separately:

  • DFS referrals only affect SMB clients connecting through the DFS namespace. NFS clients mount the SmartConnect zone directly and are not aware of DFS folder targets or referral priority.
  • After failover, NFS hosts must unmount and remount the export so they resolve to the target cluster. See Refresh NFS Mounts for the unmount/remount commands.
  • To avoid manual intervention on every NFS host, use the Eyeglass post-failover script engine to automate the unmount/remount by policy, targeting only the hosts mounting the data being failed over. Refer to the Script Engine content linked from SyncIQ Type with Eyeglass for setup details.
  • Keep NFS-mounted data on its own SmartConnect zone/IP pool, separate from the DFS-dedicated pool, so NFS remount planning is not tied to DFS referral configuration.

Linux and Samba DFS Client Access​

Samba is an SMB port for Linux, and can be used to mount SMB shares in a manner similar to NFS.

DFS-presented folders with dual referral paths have been tested with Samba. Testing showed that Samba DFS folders do not automatically switch to the SmartConnect path of the surviving cluster until the interface removal method is used to remove interfaces from the source cluster's IP pool (see Post Failover Steps for the interface removal procedure for Access Zone / IP Pool failover).

note

This interface removal workaround applies to Samba/Linux DFS clients specifically. Windows DFS clients pick up the referral change automatically without this step, as described in DFS Configuration Procedures.

Tested Environment​

ComponentVersion
Linux DistributionCentOS Linux release 7.6.1810 (Core)
SambaSamba version 4.8.3
Windows ServerWindows Server 2016 Essentials
Microsoft DFS ManagementVersion 6.0

Installing and Configuring the Linux DFS Client​

  1. Install the required packages:

    yum install -y samba samba-client cifs-utils keyutils

  2. Enable the firewall rule for SMB:

    firewall-cmd --permanent --zone=public --add-service=samba && firewall-cmd --reload && systemctl restart firewalld

  3. Modify the /etc/request-key.conf file to support SPNEGO and DNS resolution callbacks used by CIFS mounts:

    sed -i "\$acreate cifs.spnego * * /usr/sbin/cifs.upcall %k\ncreate dns_resolver * * /usr/sbin/cifs.upcall %k" /etc/request-key.conf

  4. Create a local directory to use as the mount point, and assign permissions (tested with 777):

    mkdir -p /tmp/dfs && chmod 777 /tmp/dfs

  5. Mount the DFS root (the vers=3 option can also be used):

    mount -t cifs //DOMAIN/DFSRoot /tmp/dfs -osec=ntlmv2,domain=DOMAIN,username=usr,vers=2.1

  6. Browse to the local mount directory to confirm the DFS shares are visible:

    cd /tmp/dfs && ls -lha

  7. Confirm the mount:

    df -h

Next Steps​

Return to the main DFS Failover article for prerequisites and standard configuration procedures.