{"id":160,"date":"2013-04-22T18:37:57","date_gmt":"2013-04-22T23:37:57","guid":{"rendered":"https:\/\/www.softwareab.net\/wordpress\/?p=160"},"modified":"2013-07-08T07:44:48","modified_gmt":"2013-07-08T12:44:48","slug":"esxi5-and-windows-cifs","status":"publish","type":"post","link":"https:\/\/www.softwareab.net\/wordpress\/esxi5-and-windows-cifs\/","title":{"rendered":"ESXi5 and Windows CIFS"},"content":{"rendered":"

Hello All – another chapter in the long-running story of ESXi integration in a significant project I have worked on for the 6 months: namely, the decision to upgrade ESX from 3.5 to version 5.1 was made. As all of you know, ESXi is not the “full” ESX of 3.5; instead, it is a minimal hypervisor (“bare-metal” to use VMware marketing terms). This article covers the challenges and opportunities I found in integrating the Common Internet File System (CIFS) via Windows 2008 (not<\/em> R2) with ESXi5. It was a bit of a shock to an ESXi n00b13 like myself. There is no mount<\/code> command; instead, the admin must use esxcfg-nas<\/code>. But that isn’t all…not by a long shot. For my ESXi hosts to access my Windows CIFS file server I had to take quite a few steps. This article provides three views of the problem space:<\/p>\n

    \n
  1. “Common Setup” – Things to setup on the Windows side ahead of time.<\/li>\n
  2. “Read-Write Access Shares” – How to get read-write access working.<\/li>\n
  3. “Read-Only Access Shares” – Slightly easier as no write access required.<\/li>\n<\/ol>\n

    Common Setup for ESXi<\/h2>\n

    In my case, I followed these steps for any CIFS (Windows 2008) server that requires ESXi consumer access:<\/p>\n

      \n
    1. Install Services for Network File System.<\/b> Do not reboot after mapping.<\/li>\n
    2. Setup user mapping or allow anonymous access.<\/b> User mapping requires many steps but would be preferred especially since Server 2008 only supports Linux-to-AD mapping. The blog entry at Scott Lowe’s Windows 2008 Linux-AD Integration<\/a> provides excellent detail on this process. For my environment, however, this was too complex given the small number of Linux servers. Therefore, an alternate approach to modify GPO to enable anonymous access. I created an ActiveDirectory GPO “NAS Servers with Linux CIFS” and set it as follows:\n

      Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network access: Let Everyone<\/code> permissions apply to anonymous users”.<\/em><\/li>\n

    3. Configure other NFS settings.<\/b> From admin command prompt:
      \nnfsadmin server config mountprotocol=tcp<\/code><\/li>\n
    4. Reboot the server.<\/b> This must be done for the group policy and NFS settings to be applied properly.<\/li>\n
    5. NFS Share Requirements.<\/b> NFS shares must be exposed such that ESXi hosts can access them. The ESXi hosts use esxcfg-nas<\/code> which does not support many of the functions and options that the mount<\/code> command does. So we must relax permissions on the NAS server to accommodate this. The trick is to relax permissions as minimally as possible:\n