6.7

Table Of Contents
Procedure
1 On the NFS server, configure an NFS volume and export it to be mounted on the ESXi hosts.
a Note the IP address or the DNS name of the NFS server and the full path, or folder name, for the
NFS share.
For NFS 4.1, you can collect multiple IP addresses or DNS names to use the multipathing
support that the NFS 4.1 datastore provides.
b If you plan to use Kerberos authentication with NFS 4.1, specify the Kerberos credentials to be
used by ESXi for authentication.
2 On each ESXi host, configure a VMkernel Network port for NFS traffic.
For more information, see the vSphere Networking documentation.
3 If you plan to use Kerberos authentication with the NFS 4.1 datastore, configure the ESXi hosts for
Kerberos authentication.
See Configure ESXi Hosts for Kerberos Authentication.
What to do next
You can now create an NFS datastore on the ESXi hosts.
Configure ESXi Hosts for Kerberos Authentication
If you use NFS 4.1 with Kerberos, you must perform several tasks to set up your hosts for Kerberos
authentication.
When multiple ESXi hosts share the NFS 4.1 datastore, you must use the same Active Directory
credentials for all hosts that access the shared datastore. You can automate the assignment process by
setting the user in host profiles and applying the profile to all ESXi hosts.
Prerequisites
n
Make sure that Microsoft Active Directory (AD) and NFS servers are configured to use Kerberos.
n
Enable AES256-CTS-HMAC-SHA1-96 or AES128-CTS-HMAC-SHA1-96 encryption modes on AD.
The NFS 4.1 client does not support the DES-CBC-MD5 encryption mode.
n
Make sure that the NFS server exports are configured to grant full access to the Kerberos user.
Procedure
1 Configure DNS for NFS 4.1 with Kerberos
When you use NFS 4.1 with Kerberos, you must change the DNS settings on ESXi hosts. The
settings must point to the DNS server that is configured to hand out DNS records for the Kerberos
Key Distribution Center (KDC). For example, use the Active Directory server address if AD is used
as a DNS server.
2 Configure Network Time Protocol for NFS 4.1 with Kerberos
If you use NFS 4.1 with Kerberos, configure Network Time Protocol (NTP) to make sure all ESXi
hosts on the vSphere network are synchronized.
vSphere Storage
VMware, Inc. 175