File Share ‘Scoping’ in Windows Server 2008 Failover Clusters

Implementing highly available file servers in Windows Server 2008 is very different from how it was done in previous versions of Microsoft’s clustering technology. One of the new pieces of functionality implemented in highly available file servers is ‘scoping’ of shared folders. What this means is when a shared folder is created in a Windows Server 2008 Failover Cluster, it is not only associated with two other resources in the same resource grouping – a Client Access Point (CAP) and a File Server Resource, but it will be accessible only by way of the Network Name resource which is one of two components of a Client Access Point (CAP) (the other being an IP Address). Now, one may say, "That has been the way we have always accessed file shares in the past". This is true, but things have changed a little and that is what we will be discussing here.

I will start by reviewing how things work in Windows 2003 Cluster Server and prior (termed legacy clusters). I configured a 2-Node Windows Server 2003 Server Cluster to illustrate. I created two separate resource groups containing all the required resources to support a file share (Physical Disk, IP Address, and Network Name resources). These resources were configured as described in KB224967 – How to create file shares on a cluster.

clip_image002

Using the Microsoft Server Message Block (SMB) protocol which uses a lower level protocol called NetBIOS over TCP/IP (NBT), we can construct a Uniform Naming convention (UNC) path to access the highly available file shares in the cluster (e. g. \\<NetBIOS_Name>\<share_name> ). In legacy clusters, there was no ‘scoping’ of file shares. The nature of the interaction with the local Server service was such that whatever shares were configured on the Custer node hosting the highly available resource group containing the file share being accessed (exclusive of admin shares), would be displayed if a connection was made to the NetBIOS (or Fully qualified Domain Name (FQDN)) name or IP address. The following example illustrates this point. A highly available file share resource group (TESTFS) is Online on a Cluster node (W2K3-CL1). The Cluster node has a locally shared folder (temp) configured as well which is not part of the cluster. When making a connection to either the local Cluster node name or the Network Name associated with the highly available file share, all shares configured on the Cluster node are displayed.

clip_image004

If I move the second highly available file share resource group (TESTFS2) from the second cluster node over to the node hosting the first group, I see the following display.

clip_image006

You can see that all SMB shares that now reside on the cluster node (exclusive of the admin shares) are displayed to the client making the connection. They can also be seen in the Computer Management interface –

clip_image008

The same information is displayed if a user connects using an IP address as opposed to a NetBIOS, or FQDN, name as seen here –

clip_image010

In Windows Server 2008 Failover Clusters, the interaction between the Cluster Service and the Server Service has changed. In Windows Server 2008 Failover Clusters, shared folders are now associated with a File Server resource and are ‘scoped’ to the Network Name resource which is part of a Client Access Point (CAP). To illustrate, I will step through the process of creating a highly available shared folder in a Windows Server 2008 Failover cluster (more detailed information on this process can be accessed using the content provided at the end of this blog).

In the Failover Cluster management snap-in, I create a highly available File Server using the built-in wizard-based process. When complete, a grouping of resources which consist basically of a CAP and a piece of storage that will be used to host the shared folder(s) is created. Next, in the Actions menu, select ‘Add a shared folder.’

clip_image012

This initializes another wizard-based process that is part of the Share and Storage Manager functionality that is included as part of the Windows Server 2008 operating system. The first step is to select the location for the shared folder. By default, the storage located in the resource group is selected. In this case – Disk F.

clip_image014

Select the Browse button and look for a pre-created folder to use (or I could create a new folder if desired) for the share.

clip_image016

In this case I selected the Accounting folder.

clip_image018

Modify the NTFS permissions as needed.

clip_image020

Next, select either SMB or NFS share.

clip_image022

Note: Just as an FYI, if this were an NFS share, things would be quite different because we would be using an NFS Server to provide this share to NFS clients, but that is a topic for another day.

In the next step, choose to make additional configuration settings for the SMB share as needed.

clip_image024

For example, you could limit the number of connections allowed to the share, or you could enable Access-Based Enumeration (ABE) or setup client-side caching.

clip_image026

Next, modify the share permissions as needed.

clip_image028

Publish to a DFS Namespace, if required.

clip_image030

Review the information summary and Create the shared folder.

clip_image032

Hopefully, the result is as shown here –

clip_image034

In the end, the Failover Cluster management snap-in shows the shared folder and the new File Server resource created to support it.

clip_image036

Using the same process we used with the Windows 2003 Server Cluster, we can access the shares using a UNC path. However, you will notice that the displayed information is quite different. This clearly demonstrates the concept of ‘scoping’ where file shares are associated with specific access points. The shares associated with the cluster node are only displayed when connecting to the name of the cluster node. The share(s) associated with the cluster CAP are only displayed when connecting to the Network Name which is part of that CAP.

clip_image038

Next, we try using the IP address. Here we can see that ‘scoping’ of file shares does not apply when accessing them using an IP address as part of a UNC path. Using the IP Address (1.53.0.187) which is part of the CAP, the share that is returned is quite different. Even though I used the IP address which is part of the Cluster CAP, the information displayed corresponds to the local share of the Cluster node that is hosting that IP address and not the share that is supported by the File Server resource that is part of the highly available File Server group.

clip_image040

Another method that is sometimes used to access a file share is a Canonical Name Record (CNAME) alias in DNS that points to the Network Name registration for the CAP in DNS. This will not work in Windows Server 2008 Failover Clusters. As an example, I configured a CNAME record in DNS called ‘cfileserver’. When I ping that name, I get the IP Address associated with the cluster network name resource. When I try connecting to it via a UNC path, I once again only see the local shares for the cluster node hosting that IP Address resource.

clip_image042

In summary, file share ‘scoping’ in Windows Server 2008 Failover Clusters changes the way the Cluster Service interoperates with the Server Service on a Custer node. Because of this new functionality, end users must rethink file share access when those shares are hosted in a Failover Cluster. Accessing file shares in a Windows Server 2008 Failover Cluster using SMB must be by way of the Network Name resource which is part of a cluster Client Access Point (CAP). Methods that previously used IP addresses or DNS CNAME records will not work.

For additional information on Microsoft clustering Technologies:

Windows 2008http://technet.microsoft.com/en-us/library/cc534986.aspx

Windows 2003http://www.microsoft.com/windowsserver2003/enterprise/clustering.mspx

Microsoft Clustering Team Bloghttp://blogs.msdn.com/clustering/

Thanks for your attention and I hope this information has been helpful.

Chuck Timon, Jr.
Senior Support Escalation Engineer
Microsoft Enterprise Platforms Support