SVM无法与名称服务器通信、因为没有应用所需的服务策略

适用场景

问题描述

• 无法使用域凭据进行ssh并收到以下错误消息：

2/23/2024 19:50:08  node1 ERROR secd.cifsAuth.problem: vserver (vs1) General CIFS authentication problem. Error: Ontap admin cifs authentication basic procedure failed
  [  6 ms] TCP connection to ip 10.xx.yy.yy, port 88 failed: Network is unreachable.
  [   10] TCP connection to ip 10.xx.zz.zz, port 88 failed: Network is unreachable.
  [   12] TCP connection to ip 10.11.xx.yy, port 88 failed: Network is unreachable.
  [   15] TCP connection to ip 10.22.xx.yy, port 88 failed: Network is unreachable.
**[   17] FAILURE: Could not authenticate as 'user1@domain.com': Cannot contact any KDC for requested realm (KRB5_KDC_UNREACH)
  [   20] Kerberos authentication failed. Trying NTLM
  [   20] Login attempt by domain user 'domain\user1' using NTLMv2 style security
  [   26] Failed to connect to 10.xx.yy.yy for DNS: Network is unreachable
  [   27] Failed to connect to 10.xx.zz.zz for DNS: Network is unreachable
  [   27] Failed to connect to 10.11.xx.yy for DNS: Network is unreachable
  [   29] Unable to contact DNS to discover domain controllers.
  [   29] Unable to make a connection (NetLogon:local.DOMAIN.COM), Result: RESULT_ERROR_DNS_CANT_REACH_SERVER
  [   32] Ontap-admin-login-cifs failed

• 已配置域通道：

cluster::> security login domain-tunnel show
Tunnel Vserver: vs1

• 隧道数据SVM无法访问DNS或修改为新服务器：

cluster::> vserver services name-service dns check -vserver vs1
Vserver     Name Server    Status     Status Details
------------- --------------- ------------ --------------------------
vs1         down      Network is unreachable.
10.xx.yy.yy
vs1         down      Network is unreachable.
10.xx.zz.zz
vs1         down      Network is unreachable.
10.11.xx.yy
3 entries were displayed.

 cluster::> dns modify -vserver svm1 -domains domain.com -name-servers 10.1.2.3,10.1.2.4 Error: command failed: Failed to verify the specified DNS configuration. 10.1.2.3: Network is unreachable. 10.1.2.4: Network is unreachable. Verify that the network configuration is correct and that DNS servers are available. Specify "-skip-config-validation" to skip the configuration validation