Account for NFSv3 ancillary services in NetApp firewall testing

Source facts

For Azure NetApp Files, NFSv3 uses separate services for port discovery, mounting, locking, status and quotas. Their fixed ports are 111 for Portmapper, 635 for Mount, 4045 for NLM, 4046 for NSM and 4049 for Rquota, alongside NFS on 2049. Microsoft says these port numbers cannot be changed. NFSv4 integrates locking into its protocol instead of using the ancillary locking service; Azure NetApp Files supports NFSv4.1 within that protocol family. Microsoft Learn.

Applicability

Apply this review to the actual NFS version selected for the Azure NetApp Files volume. This is a connectivity contract, not a recommendation to change protocol versions solely to simplify a firewall rule.

DSE recommendation

Make the required NFSv3 service paths explicit before accepting a firewall change. Ask the storage, client and network owners to agree which operations the workload needs and where the corresponding traffic must pass. Keep the permitted client population and destination volume alongside the port list. Avoid expanding access to unrelated networks when one operation fails; first identify which service and path produced the failure.

Verification

Use an approved client to check discovery, mounting and representative file activity through the intended controls. Include a locking exercise appropriate to the application instead of relying on a basic connection to port 2049. Compare observations with the agreed service matrix and confirm an excluded client remains excluded. Record the negotiated NFS version so results cannot be misapplied to a different protocol configuration.

Official references

Microsoft Learn: Understand NAS protocols in Azure NetApp Files.