configure secondary Service Consoles to go with iSCSI vmKernels??

[tlyczko]

All our 3 vSphere hosts have 3 dual-port NICs.

vSwitch 0, pNIC 1 and 2 = Primary SC and vmKernel for the domain subnet, 172.16.0.xxx

vSwitch 2, pNIC 4 and 5 = VM Network, all VMs are on this vSwitch

So far so good.

vSwitch 1, pNIC 2 and 3 = iSCSI networking, 1 iSCSI vmKernel per pNIC as explained elsewhere how to set up proper iSCSI vSwitches.

Example: iSCSI vmKernel 1 is 10.10.10.140 and iSCSI vmKernel 2 is 10.11.10.140 to match up with our MSA 2012i's SAN networking.

(Our consultant suggested calling them 'Backend vmKernel' -- I kept it even though it is really iSCSI.)

I've seen advice to set up secondary Service Consoles to go with the iSCSI vmKernels.

Do the secondary Service Consoles go onto vSwitch 1??? (e.g. 10.10.10.141 and 10.11.10.141)

After that could I safely set HA to 25% and “das.failuredetectiontime” to 30000 or 60000??

25% of available resources is easily enough to power on our largest VM and any single one of our hosts could run all the VMs that are enabled to restart if all the hosts go down.

I am basically trying to plan for power outages, presently our most likely to happen failure event due to powerful summer storms that can mess up the power lines etc. in our area.

Thank you, Tom

[athlon_crazy]

As per your title, if this host is vSphere 4, all iscsi stack will rely on vmkernel ONLY. No need anymore SC for iscsi authentication/login like legacy ESX (3.5).

So,

I've seen advice to set up secondary Service Consoles to go with the iSCSI vmKernels.

No need..

Do the secondary Service Consoles go onto vSwitch 1??? (e.g. 10.10.10.141 and 10.11.10.141)

No need..

In your case, Secondary SC will be needed when you need to add secondary isolation network detection for HA via different subnet instead using the first SC ONLY.

vcbMC-1.0.6 Beta

vcbMC-1.0.7 Lite

http://www.no-x.org

[tlyczko]

As per your title, if this host is vSphere 4, all iscsi stack will rely on vmkernel ONLY. No need anymore SC for iscsi authentication/login like legacy ESX (3.5).

So,

I've seen advice to set up secondary Service Consoles to go with the iSCSI vmKernels.

No need..

Do the secondary Service Consoles go onto vSwitch 1??? (e.g. 10.10.10.141 and 10.11.10.141)

No need..

In your case, Secondary SC will be needed when you need to route isolation network detection via different subnet instead using the first SC.

I don't quite understand your very last comment above about network detection.

I was reading Duncan Epping's HA Deep Dive and saw this comment, perhaps you can clarify??

"Basic design principle: For iSCSI I recommend to set the isolation response to “Power off” to avoid a possible split brain scenario. I also recommend to have a secondary service console running on the same vSwitch as the iSCSI network to detect an iSCSI outage and avoid false positives."

I also know that vSphere 4.0 Update 1 or 2 fixes the split brain issue but it's not clear to me if Duncan's suggestion should still be followed, it seems to me that he is indeed suggesting to add the additional service console to the iSCSI vSwitch that I displayed above.

I'm trying to confirm that I am reading his recommendation correctly.

Thank you, Tom

[athlon_crazy]

For iSCSI I recommend to set the isolation response to “Power off” to avoid a possible split brain scenario. I also recommend to have a secondary service console running on the same vSwitch as the iSCSI network to detect an iSCSI outage and avoid false positives."

As what I understand, he probably mean the same as what I mentioned previously. You need secondary SC on the same vSwitch as iSCSI network solely for secondary isolation network detection and not for iSCSI discovery or authentication process. This could avoid false alarm when isolation network detected on the first SC or on ESX network because VMware HA will access and check on secondary isolation address as explained in this KB. But, If you share the first & second SC on the same pSwitch, I doubt this setup will be useful.

check this

vcbMC-1.0.6 Beta

vcbMC-1.0.7 Lite

http://www.no-x.org

[tlyczko]

For iSCSI I recommend to set the isolation response to “Power off” to avoid a possible split brain scenario. I also recommend to have a secondary service console running on the same vSwitch as the iSCSI network to detect an iSCSI outage and avoid false positives."

As what I understand, he probably mean the same as what I mentioned previously. You need secondary SC on the same vSwitch as iSCSI network solely for isolation network detection and not for iSCSI discovery or authentication process. This could avoid false alarm when isolation network detected on the first SC and cause VMs failover while the connection with your iSCSI storage still fine. But, If you share the first & second SC on the same pSwitch, I doubt this setup will be useful.

What am I saying wrong??

I completely understand that one doesn't put both primary and secondary SC on the same vSwitch. I already knew before posting that it's no longer absolutely necessary in vSphere to have a secondary SC with the iSCSI vmKernels, I read your 'check this.' But Duncan seems to be saying that there should be a secondary SC with these backend iSCSI vmKernels!!

OR are you and he saying I should have the secondary SC on a completely different vSwitch than either the primary SC and the backend iSCSI vmKernels I depicted?? To me it seems what he and you are saying is that one should indeed set up additional SCs to go with the backend iSCSI vmKernels.

If you maybe know of where I could see a diagram of a properly configured setup, that would help, I fear we are getting mixed up in semantics, maybe??

Thank you, Tom

In my case that would be the VM Network vSwitch, which doesn't make sense to me from a security viewpoint.

[athlon_crazy]

Maybe I understand your Subject "configure secondary Service Consoles to go with iSCSI vmKernels" wrongly. I thought you want to have secondary SC within iSCSI vmkernel for discovery/authentication purposes.

vcbMC-1.0.6 Beta

vcbMC-1.0.7 Lite

http://www.no-x.org

[tlyczko]

Maybe I understand your Subject "configure secondary Service Consoles to go with iSCSI vmKernels" wrongly. I thought you want to have secondary SC within iSCSI vmkernel for discovery/authentication purposes.

I was posting to confirm that the secondary SC portgroups are indeed placed with the backend iSCSI vmKernel portgroups.

You seem to say that this is indeed their correct location.

I will add them to one host, then change to 25% and to 'Power off' and see if anything unusual happens thereafter, then add to the other hosts, as well as configure the "das..." setting.

Thank you, Tom