{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/", "slug": "dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing", "url": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/" }, "title": "Account for NFSv3 ancillary services in NetApp firewall testing", "summary": "Why is allowing only the NFS port insufficient to validate an Azure NetApp Files NFSv3 path?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:49+00:00", "modified_at": "2026-09-10T02:11:19+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 242, "potentially_affected": "Apply this review to the actual NFS version selected for the Azure NetApp Files volume. This is a connectivity contract, not a recommendation to change protocol versions solely to simplify a firewall rule.", "dse_recommendation": "Make the required NFSv3 service paths explicit before accepting a firewall change.", "primary_source": { "name": "Understand NAS protocols in Azure NetApp Files | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-netapp-files/network-attached-storage-protocols", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For Azure NetApp Files, NFSv3 uses separate services for port discovery, mounting, locking, status and quotas. Their fixed ports are 111 for Portmapper, 635 for Mount, 4045 for NLM, 4046 for NSM and 4049 for Rquota, alongside NFS on 2049. Microsoft says these port numbers cannot be changed. NFSv4 integrates locking into its protocol instead of using the ancillary locking service; Azure NetApp Files supports NFSv4.1 within that protocol family. Microsoft Learn.

\n

Applicability

\n

Apply this review to the actual NFS version selected for the Azure NetApp Files volume. This is a connectivity contract, not a recommendation to change protocol versions solely to simplify a firewall rule.

\n

DSE recommendation

\n

Make the required NFSv3 service paths explicit before accepting a firewall change. Ask the storage, client and network owners to agree which operations the workload needs and where the corresponding traffic must pass. Keep the permitted client population and destination volume alongside the port list. Avoid expanding access to unrelated networks when one operation fails; first identify which service and path produced the failure.

\n

Verification

\n

Use an approved client to check discovery, mounting and representative file activity through the intended controls. Include a locking exercise appropriate to the application instead of relying on a basic connection to port 2049. Compare observations with the agreed service matrix and confirm an excluded client remains excluded. Record the negotiated NFS version so results cannot be misapplied to a different protocol configuration.

\n

Official references

\n

Microsoft Learn: Understand NAS protocols in Azure NetApp Files.

", "content_text": "Source facts\nFor Azure NetApp Files, NFSv3 uses separate services for port discovery, mounting, locking, status and quotas. Their fixed ports are 111 for Portmapper, 635 for Mount, 4045 for NLM, 4046 for NSM and 4049 for Rquota, alongside NFS on 2049. Microsoft says these port numbers cannot be changed. NFSv4 integrates locking into its protocol instead of using the ancillary locking service; Azure NetApp Files supports NFSv4.1 within that protocol family. Microsoft Learn.\nApplicability\nApply this review to the actual NFS version selected for the Azure NetApp Files volume. This is a connectivity contract, not a recommendation to change protocol versions solely to simplify a firewall rule.\nDSE recommendation\nMake the required NFSv3 service paths explicit before accepting a firewall change. Ask the storage, client and network owners to agree which operations the workload needs and where the corresponding traffic must pass. Keep the permitted client population and destination volume alongside the port list. Avoid expanding access to unrelated networks when one operation fails; first identify which service and path produced the failure.\nVerification\nUse an approved client to check discovery, mounting and representative file activity through the intended controls. Include a locking exercise appropriate to the application instead of relying on a basic connection to port 2049. Compare observations with the agreed service matrix and confirm an excluded client remains excluded. Record the negotiated NFS version so results cannot be misapplied to a different protocol configuration.\nOfficial references\nMicrosoft Learn: Understand NAS protocols in Azure NetApp Files.", "content_markdown": "## Source facts\n\nFor Azure NetApp Files, NFSv3 uses separate services for port discovery, mounting, locking, status and quotas. Their fixed ports are 111 for Portmapper, 635 for Mount, 4045 for NLM, 4046 for NSM and 4049 for Rquota, alongside NFS on 2049. Microsoft says these port numbers cannot be changed. NFSv4 integrates locking into its protocol instead of using the ancillary locking service; Azure NetApp Files supports NFSv4.1 within that protocol family. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-netapp-files/network-attached-storage-protocols).\n\n## Applicability\n\nApply this review to the actual NFS version selected for the Azure NetApp Files volume. This is a connectivity contract, not a recommendation to change protocol versions solely to simplify a firewall rule.\n\n## DSE recommendation\n\nMake the required NFSv3 service paths explicit before accepting a firewall change. Ask the storage, client and network owners to agree which operations the workload needs and where the corresponding traffic must pass. Keep the permitted client population and destination volume alongside the port list. Avoid expanding access to unrelated networks when one operation fails; first identify which service and path produced the failure.\n\n## Verification\n\nUse an approved client to check discovery, mounting and representative file activity through the intended controls. Include a locking exercise appropriate to the application instead of relying on a basic connection to port 2049. Compare observations with the agreed service matrix and confirm an excluded client remains excluded. Record the negotiated NFS version so results cannot be misapplied to a different protocol configuration.\n\n## Official references\n\n[Microsoft Learn: Understand NAS protocols in Azure NetApp Files](https://learn.microsoft.com/en-us/azure/azure-netapp-files/network-attached-storage-protocols)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/", "url": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Account for NFSv3 ancillary services in NetApp firewall testing", "item": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/", "url": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/", "headline": "Account for NFSv3 ancillary services in NetApp firewall testing", "description": "Why is allowing only the NFS port insufficient to validate an Azure NetApp Files NFSv3 path?", "abstract": "Why is allowing only the NFS port insufficient to validate an Azure NetApp Files NFSv3 path?", "articleBody": "Source facts\nFor Azure NetApp Files, NFSv3 uses separate services for port discovery, mounting, locking, status and quotas. Their fixed ports are 111 for Portmapper, 635 for Mount, 4045 for NLM, 4046 for NSM and 4049 for Rquota, alongside NFS on 2049. Microsoft says these port numbers cannot be changed. NFSv4 integrates locking into its protocol instead of using the ancillary locking service; Azure NetApp Files supports NFSv4.1 within that protocol family. Microsoft Learn.\nApplicability\nApply this review to the actual NFS version selected for the Azure NetApp Files volume. This is a connectivity contract, not a recommendation to change protocol versions solely to simplify a firewall rule.\nDSE recommendation\nMake the required NFSv3 service paths explicit before accepting a firewall change. Ask the storage, client and network owners to agree which operations the workload needs and where the corresponding traffic must pass. Keep the permitted client population and destination volume alongside the port list. Avoid expanding access to unrelated networks when one operation fails; first identify which service and path produced the failure.\nVerification\nUse an approved client to check discovery, mounting and representative file activity through the intended controls. Include a locking exercise appropriate to the application instead of relying on a basic connection to port 2049. Compare observations with the agreed service matrix and confirm an excluded client remains excluded. Record the negotiated NFS version so results cannot be misapplied to a different protocol configuration.\nOfficial references\nMicrosoft Learn: Understand NAS protocols in Azure NetApp Files.", "datePublished": "2026-09-10T00:22:49+00:00", "dateModified": "2026-09-10T02:11:19+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-547-account-for-nfsv3-ancillary-services-in-netapp-firewall-testing/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Account for NFSv3 ancillary services in NetApp firewall testing" }, "articleSection": [ "Business Continuity", "Networks & Infrastructure" ], "keywords": [ "Business Continuity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 242, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Understand NAS protocols in Azure NetApp Files | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-netapp-files/network-attached-storage-protocols" } } ] } }