Correct & Reliable way to stop access to an iSCSI Target

[Michelle_Laveri]

Guys,

I'm doing more work with iSCSI than have done in the past. Normally I worked with FC SAN either on my own kit at home, or customers site.

The iSCSI system I'm using is Lefthand Networks VP called VSA together with VMware iSCSI Software Initiator...

Anyway, sometimes I want to temporarily stop access to the target after the ESX host has connected to the target. You would think this would be an easy thing to do - through obivious methods such as:

disabling the iSCSI SW Initiator

removing the ESX host from the allowed list of iSCSI Initator

closing the firewall for 3260

BUT, even after doing this - when I do a rescan the LUN and VMFS is still there. It's a classic case that when you want something NOT to work it does!

Anyway, the ONLY reliable method I've found is by changing the IP address of the VMkernel port to be something bogus - and then force a rescan - this causes the LUN/VMFS to disappear.

Does anyone else have a reliable method - which would be less intrusive?

Regards

Mike

[Ken_Cline]

Just a guess...but have you tried unloading the NIC driver?

- vmkload_mod -u

Ken Cline

Technical Director, Virtualization

Wells Landers

VMware Communities User Moderator

[sdd]

I am not familiar with the Left Hand interface, but have you tried removing the masking from the IQN of that iSCSI intiator on the target? I have done this on other arrays and while you still have the ip of the target in ESX, a rescan should show the LUN/VMFS is gone.

Regards,

Scott

[kjb007]

I've had the same issue, and I used esxcfg-swiscsi -k, to remove the stack, but that did get rid of any active LUNs, and forced me to reconfig my target info.

-KjB

[Michelle_Laveri]

I've had the same issue, and I used esxcfg-swiscsi -k, to remove the stack, but that did get rid of any active LUNs, and forced me to reconfig my target info.

-KjB

Well, I would like to keep my configuration....

I've tried using LHN to stop access but that didn't seem to help. Seems to be a by-design issue with the iSCSI sw stack from VMware (err, make that Cisco). Perhaps its because the COS is responsible for the LUN Discovery/CHAP part of the process. I will try a load and unload of the nic driver when I next have time - although I have feeling I will have script that as it might disconnect me from the ESX Host...

Regards

Mike

[kjb007]

I tried a lot of stuff when I was setting up my environment with iSCSI. I believe I also tried unloading modules, but ultimately, in order to kill the connection, i had to unload the iscsi stack with the -k. Let me know if you find a better way.

-KjB

[kjb007]

Just an FYI, I just ran this the below to remove access to a particular LUN. I have verified the config does not get removed, but the driver does stop, and the rescan removes access to an unavailable LUN.

Run esxcfg-swiscsi -k. Then rescan, esxcfg-swiscsi -s.

The LUN should be removed.

-KjB

[Michelle_Laveri]

Cool...

Thanks for testing that - I will give it a try at the next opportunity...

Regards

Mike

[Michelle_Laveri]

In the end I found the easiest way to disable/enable access to an iSCSI Target using the SW initiator was to automate what I was doing from the GUI.

esxcfg-vswif -s vswif1

esxcfg-vmknic -D iSCSI

This stopped the networking stack required for SW iSCSI from communicating to the target

esxcfg-rescan vmhba32

refresh any storage information such mounted vmfs volumes under /vmfs/volumes

Then I re-enable it with reverse

esxcfg-vswif -e vswif1

esxcfg-vmknic -e iSCSI

esxcfg-rescan vmhba32

The nice thing about this method is that it doesn't touch the SW iSCSI stack at all..

Regards

Mike

[admin]

Just an FYI, I just ran this the below to remove access to a particular LUN. I have verified the config does not get removed, but the driver does stop, and the rescan removes access to an unavailable LUN.

Run esxcfg-swiscsi -k. Then rescan, esxcfg-swiscsi -s.

The LUN should be removed.

-KjB

That's the way to do it, if you're using the S/W initiator anyway.

[wila]

Thanks Mike, it works perfectly.

I couldn't get the method KjB used to work for me, nor did my old method work as that stopped working.

One small note, the line:

esxcfg-vswif -s vswif1

is probably a typo and meant to be:

esxcfg-vswif -D vswif1

As the the -s does not exist and the -d deletes your vswif (which you probably don't want either), the -D does the opposite of what you are doing when enabling the iscsi storage again.

--

Wil

[Michelle_Laveri]

Thanks Mike, it works perfectly.

I couldn't get the method KjB used to work for me, nor did my old method work as that stopped working.

One small note, the line:

esxcfg-vswif -s vswif1

is probably a typo and meant to be:

esxcfg-vswif -D vswif1

As the the -s does not exist and the -d deletes your vswif (which you probably don't want either), the -D does the opposite of what you are doing when enabling the iscsi storage again.

--

Wil

Yes, that's right a typo... on my behalf... I meant to temporary disable/enable the iSCSI-COS and iSCSI-VMK and then do the rescan...

Regards

Mike