古いONTAP、具体的にはONTAP 8.3.2環境の移行案件があったので、検証のためにONTAP simulatorのONTAP 8.3.2版を仮想環境上に作成して、Active Directoryに参加しようとしたところ下記のエラーとなった。（なお、接続先Active Direcrotyはsamba 4.14.5で構成している)
ontap832::> vserver cifs create -cifs-server share226 -domain adosakana.local -vserver share226
In order to create an Active Directory machine account for the CIFS server, you
must supply the name and password of a Windows account with sufficient
privileges to add computers to the "CN=Computers" container within the
ADOSAKANA.LOCAL domain.
Enter the user name: administrator
Enter the password:
Error: Machine account creation procedure failed
[ 12154] Loaded the preliminary configuration.
[ 12332] Created a machine account in the domain
[ 12339] Successfully connected to 172.17.44.49:445 using TCP
[ 12351] Unable to connect to LSA service on
samba.adosakana.local (Error:
RESULT_ERROR_GENERAL_FAILURE)
[ 14357] TCP connection to 172.17.44.141:445 via interface
172.17.44.236 failed: (Operation timed out).
[ 14357] Could not open a socket to 'samba.adosakana.local'
[ 14357] Unable to connect to LSA service on
samba.adosakana.local (Error:
RESULT_ERROR_SPINCLIENT_UNABLE_TO_RESOLVE_SERVER)
[ 14357] No servers available for MS_LSA, vserver: 2, domain:
adosakana.local.
**[ 14357] FAILURE: Unable to make a connection (LSA:adosakana.local),
** result: 6940
[ 14357] Could not find Windows SID
'S-1-5-21-937304154-1581684492-536532533-512'
[ 14381] Deleted existing account
'CN=SHARE226,CN=Computers,DC=adosakana,DC=local'
Error: command failed: Failed to create the Active Directory machine account
"SHARE226". Reason: SecD Error: no server available.
ontap832::>
これは暗号化の問題なので「vserver cifs security show」で設定項目を確認する。
ontap832::> vserver cifs security show -vserver share226
Vserver: share226
Kerberos Clock Skew: - minutes
Kerberos Ticket Age: - hours
Kerberos Renewal Age: - days
Kerberos KDC Timeout: - seconds
Is Signing Required: -
Is Password Complexity Required: -
Use start_tls For AD LDAP connection: false
Is AES Encryption Enabled: false
LM Compatibility Level: lm-ntlm-ntlmv2-krb
Is SMB Encryption Required: -
ontap832::>
ONTAP 8.3.2無印では関連するオプション「SMB2 Enabled for DC Connections」を設定する項目が無い
ontap832::> version -node *
ontap832-01:
NetApp Release 8.3.2: Tue Feb 23 23:35:06 UTC 2016
ontap832::>
アップデータを探したところ、832P12_q_image.tgz(リンク先はNetAppサポートサイトにログインを済ませてからアクセス) があったので、「ONTAP 9.7シミュレータをアップデートする手法」と同じ手法でアップデートを行った。
ontap832::> version -node *
ontap832-01:
NetApp Release 8.3.2P12: Mon Aug 14 02:57:01 UTC 2017
ontap832::>
ONTAP 8.3.2P12であれば、「SMB2 Enabled for DC Connections」が存在していた。
ontap832::> vserver cifs security show -vserver share226
Vserver: share226
Kerberos Clock Skew: - minutes
Kerberos Ticket Age: - hours
Kerberos Renewal Age: - days
Kerberos KDC Timeout: - seconds
Is Signing Required: -
Is Password Complexity Required: -
Use start_tls For AD LDAP connection: false
Is AES Encryption Enabled: false
LM Compatibility Level: lm-ntlm-ntlmv2-krb
Is SMB Encryption Required: -
SMB1 Enabled for DC Connections: -
SMB2 Enabled for DC Connections: -
ontap832::>
設定を変更
ontap832::> vserver cifs security modify -vserver share226 -smb1-enabled-for-dc-connections false -smb2-enabled-for-dc-connections true
ontap832::> vserver cifs security show -vserver share226
Vserver: share226
Kerberos Clock Skew: - minutes
Kerberos Ticket Age: - hours
Kerberos Renewal Age: - days
Kerberos KDC Timeout: - seconds
Is Signing Required: -
Is Password Complexity Required: -
Use start_tls For AD LDAP connection: false
Is AES Encryption Enabled: false
LM Compatibility Level: lm-ntlm-ntlmv2-krb
Is SMB Encryption Required: -
SMB1 Enabled for DC Connections: false
SMB2 Enabled for DC Connections: true
ontap832::>
そして、Active Directoryへの参加
ontap832::> vserver cifs create -cifs-server share226 -domain adosakana.local -vserver share226
In order to create an Active Directory machine account for the CIFS server, you
must supply the name and password of a Windows account with sufficient
privileges to add computers to the "CN=Computers" container within the
ADOSAKANA.LOCAL domain.
Enter the user name: administrator
Enter the password:
Warning: An account by this name already exists in Active Directory at
CN=SHARE226,CN=Computers,DC=adosakana,DC=local
Ok to reuse this account? {y|n}: y
ontap832::>
今度は成功した。