FSx for NetApp ONTAP with SVM DNS Name Not Resolvable from EC2

Question

I have an FSx for NetApp ONTAP file system with an SVM. The file system is in AVAILABLE state and the SVM shows as "Created." But when I try to mount the NFS volume from my EC2 instance:

```bash
sudo mount -t nfs svm-0abc123def456.fs-0abc123def456.fsx.us-east-1.amazonaws.com:/pg_data /var/lib/postgresql/data
```

I get:
```
mount.nfs: Failed to resolve server svm-0abc123def456.fs-0abc123def456.fsx.us-east-1.amazonaws.com: Name or service not known
```

The EC2 instance is in the same VPC as the FSx file system. Security groups allow NFS (2049). I can ping other instances in the VPC. What's wrong with DNS?

Lucky Ikani · Accepted Answer

Hello Crown,

The repost Agent is correct. The FSx SVM DNS name is resolved via the **VPC's Route 53 Resolver** (the `.2` address of your VPC CIDR). If your EC2 instance isn't using the VPC DNS server, it can't resolve FSx DNS names.

**Troubleshooting Steps - Check these in order:**

**1. VPC DNS settings not enabled:**

The VPC must have both `enableDnsSupport` and `enableDnsHostnames` set to `true`:

```bash
aws ec2 describe-vpc-attribute --vpc-id vpc-123 --attribute enableDnsSupport
aws ec2 describe-vpc-attribute --vpc-id vpc-123 --attribute enableDnsHostnames
```

If either is `false`:
```bash
aws ec2 modify-vpc-attribute --vpc-id vpc-123 --enable-dns-support '{"Value": true}'
aws ec2 modify-vpc-attribute --vpc-id vpc-123 --enable-dns-hostnames '{"Value": true}'
```

**2. Custom DHCP option set overriding DNS:**

If your VPC uses a custom DHCP option set with a non-AWS DNS server, the instance won't use the VPC resolver:

```bash
aws ec2 describe-dhcp-options --dhcp-options-ids $(aws ec2 describe-vpcs --vpc-ids vpc-123 --query 'Vpcs[0].DhcpOptionsId' --output text)
```

If `domain-name-servers` is set to something other than `AmazonProvidedDNS`, that's your problem. Either:
- Change the DHCP option set to use `AmazonProvidedDNS`
- Or add the VPC DNS server (VPC CIDR base + 2, e.g., `10.0.0.2`) as a forwarder in your custom DNS

**3. Instance has manually modified /etc/resolv.conf:**

```bash
cat /etc/resolv.conf
```

If it doesn't point to the VPC DNS (e.g., `10.0.0.2` for a 10.0.0.0/16 VPC), fix it:
```bash
# For Amazon Linux 2023 / systemd-resolved
sudo systemctl restart systemd-resolved

# Or manually (temporary)
echo "nameserver 10.0.0.2" | sudo tee /etc/resolv.conf
```

**4. Workaround - Use the SVM's IP address directly:**

If you can't fix DNS immediately, get the SVM's NFS endpoint IP and mount using the IP:

```bash
# Get SVM endpoints
aws fsx describe-storage-virtual-machines \
  --filters Name=file-system-id,Values=fs-abc \
  --query 'StorageVirtualMachines[0].Endpoints.Nfs.IpAddresses'

# Mount using IP directly
sudo mount -t nfs 10.0.1.50:/pg_data /var/lib/postgresql/data
```

**5. Verify DNS resolution works after fix:**

```bash
nslookup svm-0abc123def456.fs-0abc123def456.fsx.us-east-1.amazonaws.com
# Should return the SVM's private IP address
```

**References:**
- [FSx for NetApp ONTAP - Accessing Data](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/accessing-data.html)
- [VPC DNS Support](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html)
- [DHCP Option Sets](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html)
- [FSx for ONTAP - Mounting NFS Volumes](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/attach-linux-client.html)

Florian Turnwald · Answer

### 3. Alternative Scenario: Active Directory-Joined SVMs & AD-Integrated DNS

If your FSx for NetApp ONTAP Storage Virtual Machine (SVM) is joined to an Active Directory domain (either AWS Managed Microsoft AD or a self-managed/on-premises AD), you have the option to leverage AD-integrated DNS names instead of the native AWS FSx DNS endpoints.

In enterprise environments—especially when utilizing SMB or NFS with Kerberos authentication—this is often the preferred routing method. Here is how this changes the DNS architecture and troubleshooting:

* **AD-Integrated FQDNs:** When the SVM joins the Active Directory domain, it automatically registers its network interfaces and DNS records with your AD Domain Controllers (DCs). This allows you to mount the volume using a standard corporate Fully Qualified Domain Name (FQDN) instead of the long AWS-generated string.
 * **DHCP Options Set Adjustment:** For your EC2 instances to resolve this corporate name, your VPC **DHCP Options Set** must point directly to your Active Directory Domain Controllers as the primary DNS servers, instead of using AmazonProvidedDNS.
 * **The Conditional Forwarder Catch (Crucial):** Once your EC2 instances use your corporate AD DCs for DNS, they will lose the native ability to resolve internal AWS endpoints (such as the default *.amazonaws.com FSx names or interface VPC endpoints).
   * **The Fix:** You must configure a **Conditional Forwarder** on your Active Directory DNS servers.
   * Set it to forward all queries for amazonaws.com (and/or internal) to the AWS Route 53 Resolver / VPC DNS server (the VPC CIDR base IP plus 2, e.g., 10.0.0.2).
By ensuring your AD DCs forward AWS-bound queries back to the VPC resolver, your EC2 instances will be able to seamlessly resolve both your custom corporate AD names and any native AWS resource names.

PS: Also, if you are using a private hosted Zone in Route53, you can simply create A records there for your SVMs as well for the FSxN (e.g. Management Address) …

re:Post Agent · Answer

Based on the DNS resolution failure, there are several VPC DNS configuration requirements that need to be verified for FSx for ONTAP SVM DNS names to resolve properly:

**VPC DNS Configuration Requirements:**

1. **DNS Resolution Enabled**: The VPC must have DNS resolution enabled. This ensures that the VPC can use the Amazon-provided DNS server to resolve DNS hostnames.

2. **DNS Hostnames Enabled**: The VPC must have DNS hostnames enabled. This is required for the FSx DNS names to be resolvable within the VPC.

3. **Amazon DNS Server**: The EC2 instance must be configured to use the DNS server provided by Amazon. By default, instances use the Amazon DNS server at the VPC base IP address plus two (for example, 10.0.0.2 for a 10.0.0.0/16 VPC).

4. **DHCP Options Set**: Verify that the VPC is using the default DHCP options set, or if using a custom DHCP options set, ensure it's configured to use the Amazon-provided DNS server.

**Additional Considerations:**

- Ensure there is a mount target in the same Availability Zone as the EC2 instance for optimal performance and connectivity.

- If the file system was recently created, DNS records may take some time to propagate fully. It's recommended to wait approximately 90 seconds after creating a mount target before attempting to mount.

- Verify that both the EC2 instance and the FSx file system are in the same VPC and that the instance is not trying to access the file system from a different VPC without proper routing configuration.

Check these DNS settings in the VPC console under the VPC's details page. If DNS resolution and DNS hostnames are not enabled, enable them and then retry the mount operation.  
**Sources**  
[Troubleshooting mount issues - Amazon Elastic File System](https://docs.aws.amazon.com/efs/latest/ug/troubleshooting-efs-mounting.html)  
[Mounting on Amazon EC2 with a DNS name - Amazon Elastic File System](https://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html)  
[Accessing your FSx for ONTAP data - FSx for ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/supported-fsx-clients.html)

FSx for NetApp ONTAP with SVM DNS Name Not Resolvable from EC2

3. Alternative Scenario: Active Directory-Joined SVMs & AD-Integrated DNS

Add your answer

Relevant content