Data Domain Net Filter admin-interface change requires running NIC
Summary: When configuring the admin-interface setting in the Data Domain Net Filter, the selected network interface (NIC) must be in a running state. This ensures uninterrupted access to management services such as SSH and HTTPS. ...
Symptoms
1) The following net filter command fails with error for invalid state or configuration due to require of viable NIC.
net filter config set admin-interface error:
**** Failed to update admin-interface for IPv4: ip address check failed for interface <NIC name>
**** Failed to update admin-interface for IPv4: interface <NIC name> is not RUNNING
**** Failed to update admin-interface for IPv4: interface <NIC name> does not exist
2) net filter admin-interface allows connections to the configured NIC for SSH (22) and HTTPS(443) even if other rules try to prevent the connection attempt.
# net filter config show
Option Value Ports Clients
-------------------- ----- ------ -----------
IPv4 admin-interface ethV0 22,443 all clients
IPv6 admin-interface ethV0 22,443 all clients
-------------------- ----- ------ -----------
3) adminaccess rules would still be honored and prevent authentication if so configured.
# adminaccess show
Service Enabled Allowed Hosts
----------- ------- -------------
ssh yes <Your client IPs or ranges>
scp yes (same as ssh)
telnet no -
ftp no -
ftps no -
http no <Your client IPs or ranges>
https yes <Your client IPs or ranges>
web-service yes N/A
----------- ------- -------------
Cause
The admin-interface setting is designed to safeguard management access to the system via SSH and HTTPS. To prevent accidental loss of connectivity, the configuration requires the specified NIC to be in a running state. If the NIC is down or missing, the system blocks the change to avoid misconfiguration.
Resolution
To successfully configure the admin-interface:
- Ensure the target NIC is in a running state before applying changes.
- To restrict access to specific clients:
-
net filter config set admin-interface <NIC in running state> client <Client IP>
-
To reset the admin-interface configuration and allow default access via the first available running NIC .
net filter config reset admin-interface