You must have a working Kerberos setup with a key distribution center (KDC), such as Windows Active Directory based Kerberos or MIT Kerberos.

NFS servers must use nfs as the primary component of their machine principal.

You must use a secure directory service in your environment, such as Active Directory or OpenLDAP, that is configured to use LDAP over SSL/TLS.

You must have a working time server running NTP. This is necessary to prevent Kerberos authentication failure due to time skew.

Each UNIX client and each SVM LIF must have a proper service record (SRV) registered with the KDC under forward and reverse lookup zones. All participants must be properly resolvable via DNS.

Each client must have a user account in the Kerberos realm. NFS servers must use “nfs” as the primary component of their machine principal.

Each client must be properly configured to communicate over the network using NFSv3 or NFSv4.

Clients must support RFC1964 and RFC2203.

Each client must be properly configured to use Kerberos authentication, including the following details:

This provides the best compatibility and reliability for AES encryption with Kerberos.

Each client must be properly configured to use DNS for correct name resolution.

Each client must be synchronizing with the NTP server.

Each client’s /etc/hosts and /etc/resolv.conf files must contain the correct host name and DNS information, respectively.

Each client must have a keytab file from the KDC. The realm must be in uppercase letters. The encryption type must be AES-256 for strongest security.

The storage system must have a valid NFS license installed.

The CIFS license is optional. It is only required for checking Windows credentials when using multiprotocol name mapping. It is not required in a strict UNIX-only environment.

You must have at least one SVM configured on the system.

You must have configured DNS on each SVM.

You must have configured NFS on the SVM.

For strongest security, you must configure the NFS server to allow only AES-256 encryption for Kerberos.

If you are running a multiprotocol environment, you must have configured SMB on the SVM. The SMB server is required for multiprotocol name mapping.

You must have a root volume and at least one data volume configured for use by the SVM.

The root volume of the SVM must have the following configuration:

In contrast to the root volume, data volumes can have either security style.

The SVM must have the following UNIX groups configured:

The SVM must have the following UNIX users configured:

The nfs user is not required if a Kerberos-UNIX name mapping exists for the SPN of the NFS client user.

You must have configured export policies with the necessary export rules for the root and data volumes and qtrees. If all volumes of the SVM are accessed over Kerberos, you can set the export rule options -rorule, -rwrule, and -superuser for the root volume to krb5 , krb5i, or krb5p.

If you want the user identified by the NFS client user SPN to have root permissions, you must create a name mapping to root.