· How to allow or deny access to an SMB share using the "host-acl"   Introduction  System administrators can configure OneFS so that specific hosts identified by host name, IP address, subnet, suffix, or ALL, will be allowed or denied access to an SMB share or shares.   Procedure  For the following examples, open a secure shell (SSH) connection on any node in the cluster, log on using the root account, and run the specified command.  NOTE When you configure host-acl on a share, it will take approximately 30 seconds for the configuration to refresh and for the change to be applied to the rest of the nodes in the cluster. SMB file sharing services will not be interrupted. Change the default setting for existing and newly created shares  You can configure the default setting so that specific hosts will be allowed or denied access to all existing shares as well as any new shares created in the future.  The following example allows access to all shares by one host, specified by IP address:     isi smb config share modify --host-acl=allow:137.69.150.139,deny:ALL  To verify the default setting, run the following command:     isi smb config share list --defaults |grep host-acl  Output similar to the following will be returned:     host-acl = allow:137.69.150.139,deny:ALL  To revert changes made to the default value, run the following command:     isi smb config share revert --host-acl  Allow one host to access a specific share  You can allow or deny access of a host to a specific share.  NOTE Share-specific settings override any default settings that might have been configured.  The following example allows access to the share called cool by one host, specified by host name:     isi smb config share modify --sharename=cool --host-acl=allow:imac.w2k.isilon.com,deny:ALL  To verify that a specific share has host-acl configured, run the following command. In this example, the share called cool is being verified.     isi smb config share list --sharename=cool  Output similar to the following will be returned:     host-acl = allow:imac.w2k.isilon.com,deny:ALL  To revert the changes to the default value:     isi smb config share revert --sharename=cool --host-acl  Allow multiple hosts access to a specific share  You can allow or deny access of multiple hosts to a specific share by adding comma separated entries.  The following example allows access to two hosts, one specified by IP address and the other by host name:     isi smb config share modify --sharename=cool --host-acl=allow:137.69.150.139,allow:imac.w2k.isilon.com,deny:ALL  Deny all hosts in a specific subnet, but allow a specific host suffix  You can allow or deny access to an entire subnet but allow an exception using the EXCEPT variable.  The following example denies access to the entire subnet, 10.0.0.0/8 and allows access for all hosts with a prefix of "imac". In this example, the share is named cool.     isi smb config share modify --sharename=cool --host-acl='deny:10.0.0.0/8 EXCEPT imac'
I am setting up couple of SMB Shares on Isilon. I can give permission from active directory. Is there a way to limit/allow access to SMB Shares by IP address/Subnet. Or it has to be done on external networking - like access lists or firewall.
Can access to SMB shares on Isilon be limited by IP address?