6.7

Table Of Contents
n
If you use multiple ports for NFS traffic, make sure that you correctly configure your virtual switches
and physical switches.
n
NFS 3 and NFS 4.1 support IPv6.
NFS File Locking
File locking mechanisms are used to restrict access to data stored on a server to only one user or
process at a time. NFS 3 and NFS 4.1 use incompatible file locking mechanisms.
NFS 3 locking on ESXi does not use the Network Lock Manager (NLM) protocol. Instead, VMware
provides its own locking protocol. NFS 3 locks are implemented by creating lock files on the NFS server.
Lock files are named .lck-file_id..
NFS 4.1 uses share reservations as a locking mechanism.
Because NFS 3 and NFS 4.1 clients do not use the same locking protocol, you cannot use different NFS
versions to mount the same datastore on multiple hosts. Accessing the same virtual disks from two
incompatible clients might result in incorrect behavior and cause data corruption.
NFS Security
With NFS 3 and NFS 4.1, ESXi supports the AUTH_SYS security. In addition, for NFS 4.1, the Kerberos
security mechanism is supported.
NFS 3 supports the AUTH_SYS security mechanism. With this mechanism, storage traffic is transmitted
in an unencrypted format across the LAN. Because of this limited security, use NFS storage on trusted
networks only and isolate the traffic on separate physical switches. You can also use a private VLAN.
NFS 4.1 supports the Kerberos authentication protocol to secure communications with the NFS server.
Nonroot users can access files when Kerberos is used. For more information, see Using Kerberos for
NFS 4.1.
In addition to Kerberos, NFS 4.1 supports traditional non-Kerberos mounts with the AUTH_SYS security.
In this case, use root access guidelines for NFS version 3.
Note You cannot use two security mechanisms, AUTH_SYS and Kerberos, for the same NFS 4.1
datastore shared by multiple hosts.
NFS Multipathing
While NFS 3 with ESXi does not provide multipathing support, NFS 4.1 supports multiple paths.
NFS 3 uses one TCP connection for I/O. As a result, ESXi supports I/O on only one IP address or
hostname for the NFS server, and does not support multiple paths. Depending on your network
infrastructure and configuration, you can use the network stack to configure multiple connections to the
storage targets. In this case, you must have multiple datastores, each datastore using separate network
connections between the host and the storage.
vSphere Storage
VMware, Inc. 170