Export policy and rule concepts

Export policies enable you to restrict access to volumes to clients that match specific IP addresses and specific authentication types. Clients cannot access data on a Vserver until you create an export policy and export rules.

Each volume is associated with exactly one export policy. Each export policy is identified by a unique name and a unique numeric ID. A Data ONTAP cluster can contain up to 1,024 export policies. Each Vserver has at least one export policy called default, which contains no rules. This export policy cannot be deleted, although it can be renamed or modified. Each volume on a Vserver by default is associated with the default export policy.

Export policies consist of individual export rules. An export policy can contain a large number of rules (approximately 4,000). Each rule specifies access permissions to volumes for one or more clients. The clients can be specified by hostname, IP address, or netgroup.

Rules are processed in the order in which they appear in the export policy. The rule order is dictated by the rule index number.

The rule also specifies the authentication types that are required for both read-only and read-write operations. To have any access to a volume, matching clients must authenticate with the authentication type specified by the read-only rule. To have write access to the volume, matching clients must authenticate with the authentication type specified by the read-write rule. If a client makes an access request that is not permitted by the applicable export policy, the request fails with a permission-denied message. If a client IP address does not match any rule in the volume's export policy, then access is denied. If an export policy is empty, then all accesses are implicitly denied.

Export rules can use host entries from a netgroup.

You can modify an export policy dynamically on a running Data ONTAP system.