ONTAP 9: How NFS Export Policies Are Evaluated

This is the stored ONTAP 9 NFS policy overview, checked against the matching official English explanation.

When evaluation occurs

• An NFS client accesses the namespace without an existing cached access decision.
• During mount, the root-volume export policy is checked before the target volume or qtree policy.
• Subsequent access uses the relevant volume policy, or the qtree policy when qtree exports apply and are enabled.

Rules and caching

Rules are processed in numerical order until the client matches a rule. The matching rule’s access/security settings determine the applicable access; later rules are not a way to override that match. Completed evaluation creates an access-cache entry.

Related name-service caches retain hostname, domain and netgroup information. A lookup failure or slow name service can affect evaluation and cause delay/error responses; it should not be interpreted as permission to skip matching rules or grant access.

Ordering and grouping clients

The source recommends considering explicit IP addresses, subnets, hostnames, domains and netgroups in that order to reduce dependence on name-service availability, with the most restrictive/specific entries before broader entries within each group. This is policy-design guidance; actual evaluation follows rule indexes, not an automatic sort by client-match type.

A client-match field can contain a comma-separated list of IP addresses or hostnames, allowing clients with identical access requirements to share a rule. Review each rule’s security and access options when grouping clients.

References from the source

• TR-4067: NFS best practices, source reference to section 4 on export policies and rules.
• TR-4668: Name services best practices, source reference to section 6 on caching.

Section numbers are from the source’s report versions and may differ in newer editions.