Cisco SN 5428 Storage Router Software Configuration Guide, Release 3.3 - Chapter 6 - Configuring SCSI Routing [Cisco SN 5400 Series Storage Routers]

Table Of Contents

Configuring SCSI Routing

Prerequisite Tasks

Configuration Tasks

Creating a SCSI Routing Instance

Configuring a Server Interface

Configuring iSCSI Targets

Creating and Configuring an Access List

Configuring Access to iSCSI Targets

Verifying and Saving Configuration

Configuring SCSI Routing

This chapter explains how to configure your SN 5428 Storage Router for SCSI routing and contains the following sections:

•Prerequisite Tasks

•Configuration Tasks

•Creating a SCSI Routing Instance

•Configuring a Server Interface

•Configuring iSCSI Targets

•Creating and Configuring an Access List

•Configuring Access to iSCSI Targets

•Verifying and Saving Configuration

SCSI routing can be configured using CLI commands, as described in this chapter, or via the web-based GUI. To access the web-based GUI, point your browser to the storage router's management interface IP address. After logging on, click the Help link to access online help for the GUI.

Prerequisite Tasks

Before configuring SCSI routing, make sure you have configured all system parameters as described in "First-Time Configuration," or "Configuring System Parameters."

If the VLAN service is to be used with the SN 5428 Storage Router, configure VLANs as described in "Configuring for VLAN," before proceeding.

Configuration Tasks

To configure SCSI routing on your SN 5428 Storage Router, perform the following steps:

Step 1 Create a SCSI routing instance. Once an instance is created, you will configure that instance with parameters for a server interface, iSCSI targets, and access by IP hosts.

Step 2 Configure a server interface with or without VLAN.

Step 3 Configure iSCSI targets.

Step 4 (Optional) Create and configure a named access list. A named access list contains IP host identification information and is necessary if you want to control access to iSCSI targets on a per-IP host basis.

Step 5 Configure access to iSCSI targets. Associate named access lists to iSCSI targets to control target access on a per-IP host basis, or allow any IP host access to iSCSI targets.

Step 6 Verify and save configuration.

Note Although this is shown as the last step, you can verify and save the configuration at any point in the process of performing the configuration tasks. Save your configuration by using the save all bootconfig CLI command. This command saves all configuration data to the bootable configuration, which is then used when the storage router is rebooted.

Caution When making changes to a SCSI routing instance (such as adding or deleting targets or changing access) be sure to make the complementary changes to the iSCSI driver configuration of IP hosts that use that SCSI routing instance to access the storage resources. See the readme files for the appropriate iSCSI drivers for additional details. (You can access the latest iSCSI drivers and readme and example configuration files from Cisco.com.)

Figure 6-1 illustrates SCSI routing configuration elements, and Figure 6-2 illustrates the example configuration used in this chapter. Figure 6-3 illustrates how the configuration of SCSI routing instances determines VLAN access to storage devices.

Note Configuring the SCSI routing instance does not include configuring the Fibre Channel (FC) interfaces. Once the SCSI routing instance is configured, all the FC interfaces are available. See "Configuring Fibre Channel Interfaces," for more information on the FC interfaces and default characteristics.

Figure 6-1 Configuration Elements for SCSI Routing

Figure 6-2 SCSI Routing Parameters Example Configuration

Figure 6-3 Configuration of SCSI Routing Instance Determines VLAN Access to Storage Devices

Creating a SCSI Routing Instance

Creating a SCSI routing instance consists of naming the new instance. Use the following procedure to create a SCSI routing instance.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus

Create a SCSI routing instance by naming the new instance (zeus).

Note You can define up to 12 instances on a single SN 5428 or across a cluster. See "Configuring a High Availability Cluster," for additional details about configuring clusters for high availability.

Configuring a Server Interface

Configuring a server interface consists of assigning a primary Gigabit Ethernet interface along with an IP address and subnet mask to the desired SCSI routing instance. If the SN 5428 is to be used with VLAN, specify the VLAN by its VID.

You can also choose one of the following configuration options:

•Each SCSI routing instance can be configured with multiple server interfaces. This allows IP hosts to connect to the instance and access iSCSI targets using any of the assigned server interface IP addresses.

•Each server interface can be assigned a secondary Gigabit Ethernet interface. The server interface IP address automatically moves to the secondary Gigabit Ethernet interface if the connection to the IP host from the primary Gigabit Ethernet interface is lost. To use this feature, both Gigabit Ethernet interfaces must be connected to the same network.

Note If you configure a Gigabit Ethernet IP address with a secondary interface, all Gigabit Ethernet IP addresses on the same subnet must also be configured with the same secondary interface.

Note The IP address assigned to the server interface for the SCSI routing instance cannot be on the same subnet as any other network interface.

Without VLAN

Use the following procedure to configure a server interface for a SCSI routing instance.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus serverif ge2 10.1.0.45/24

Assign a server interface (ge2) to the desired SCSI routing instance (zeus). Specify the IP address and subnet mask (10.1.0.45/24) that IP hosts will use to access the SCSI routing instance. In this example, the subnet mask of 255.255.255.0 was set using CIDR style (/24).

With VLAN

Use the following procedure to assign a server interface and VLAN to a SCSI routing instance.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus serverif ge2 vlan 100 10.1.0.45/24

Assign a VLAN, identified by its VID (100), to the desired SCSI routing instance (zeus). Specify the server interface (ge2) and the IP address and subnet mask (10.1.0.45/24) that the VLAN will use to access the SCSI routing instance. In this example, the subnet mask of 255.255.255.0 was set using CIDR style (/24).

Note To look up the VID, use the show vlan command. VIDs are listed in the VLAN column.

Configuring iSCSI Targets

Configuring iSCSI targets consists of specifying the SCSI routing instance to which an iSCSI target is to be assigned, specifying the iSCSI target name, and mapping the iSCSI target to a physical storage device. When assigning an iSCSI target, you can specify the physical storage device either by physical storage address, LUN serial number, or by an index number assigned to the device.

Note When a new iSCSI target is configured, IP hosts do not have access to it. You need to configure access to newly created iSCSI targets according to the "Configuring Access to iSCSI Targets" section later in this chapter.

Use the procedures that follow according to mapping type and storage addressing type:

•Target-and-LUN mapping using WWPN addressing

•Target-and-LUN mapping using LUN ID addressing

•Target-and-LUN mapping using LUN Serial Number addressing

•Target-only mapping using WWPN addressing

Example 6-1 Indexed List of Storage Devices by LUN ID
                                   Device
Id   I/F  Lunid              Lun   Type    Vendor   Product
--- ----- ------------------ ----- ------  -------- ----------
1   fc4   2000002037191505   0     Disk    SEAGATE  ST318452FC
2   fc4   200000203719129d   0     Disk    SEAGATE  ST319452FC
3   fc4   200000203719152e   0     Disk    SEAGATE  ST319453FC
4   fc4   20000020371912da   0     Disk    SEAGATE  ST319452FC
Example 6-2 Indexed List of Storage Devices by WWPN
                                   Device
Id   I/F  WWPN               Lun   Type    Vendor   Product
--- ----- ------------------ ----- ------  -------- ----------
1   fc4   2200002037191505   0     Disk    SEAGATE  ST319451FC
2   fc4   220000203719129d   0     Disk    SEAGATE  ST319452FC
3   fc4   220000203719152e   0     Disk    SEAGATE  ST319453FC
4   fc4   22000020371912da   0     Disk    SEAGATE  ST319452FC
Example 6-3 Indexed List of Storage Devices by Serial Number
                                     Device
Id   I/F  Serial               Lun   Type    Vendor   Product
--- ----- ------------------   ----- ------  -------- ----------
1   fc4   LS092288000019512N3V 0     Disk    SEAGATE  ST319451FC
2   fc4   LS101990000019411NGQ 0     Disk    SEAGATE  ST319452FC
3   fc4   LS093221000019451JM5 0     Disk    SEAGATE  ST319453FC
4   fc4   LS097776000019511C3B 0     Disk    SEAGATE  ST319452FC
Target-and-LUN mapping using WWPN addressing

Use the following procedure to map iSCSI targets to storage devices by physical storage address.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target chimaera_apps lun 24 wwpn 2200002037191505 lun 0

Specify desired SCSI routing instance (zeus). Specify iSCSI target (chimaera_apps) and LUN (24), and map it to the desired physical address (WWPN 2200002037191505 LUN 0).

Use the following procedure to map iSCSI targets to storage devices by an index number.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target chimaera_apps lun 31 wwpn #?

Specify desired SCSI routing instance (zeus). Specify iSCSI target (chimaera_apps) and LUN (31), and prompt for an indexed list of available storage addresses using the number sign and a question mark (#?).

Step 3

scsirouter zeus target chimaera_apps lun 31 wwpn #1

Choose a physical address designated by an index number (see index number 1 in Example 6-2) to map the iSCSI target (chimaera_apps) and LUN (31) combination to the desired physical address (WWPN 2200002037191505, LUN 0).

Target-and-LUN mapping using LUN ID addressing

Use the following procedure to map iSCSI targets to storage devices by physical storage address.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target chimaera_eng lun 17 lunid 200000203719129d

Specify desired SCSI routing instance (zeus). Specify iSCSI target (chimaera_eng) and LUN (17), and map it to the desired physical address (LUN ID 200000203719129d).

Use the following procedure to map iSCSI targets to storage devices by an index number.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target chimaera_eng lun 17 lunid #?

Specify desired SCSI routing instance (zeus). Specify iSCSI target (chimaera_eng) and LUN (17), and prompt for an indexed list of available storage addresses using the number sign and a question mark (#?).

Step 3

scsirouter zeus target chimaera_eng lun 17 lunid #2

Choose a physical address designated by an index number (see index number 2 in Example 6-1) to map the iSCSI target (chimaera_eng) and LUN (17) combination to the desired physical address (LUN ID 200000203719129d)

Target-and-LUN mapping using LUN Serial Number addressing

Use the following procedure to map iSCSI targets to storage devices by serial number.

Note The storage resource must support unique serial numbers for each LUN.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target pegasus_web lun 3 serial LS093221000019451JM5

Specify desired SCSI routing instance (zeus). Specify iSCSI target (pegasus_web) and LUN (3), and map it to the desired physical address (serial number LS093221000019451JM5).

Use the following procedure to map iSCSI targets to storage devices by an index number.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target pegasus_web lun 3 serial #?

Specify desired SCSI routing instance (zeus). Specify iSCSI target (pegasus_web) and LUN (3), and prompt for an indexed list of available storage addresses using the number sign and a question mark (#?).

Step 3

scsirouter zeus target pegasus_web lun 3 serial #3

Choose a physical address designated by an index number (see index number 3 in Example 6-3) to map the iSCSI target (pegasus_web) and LUN (3) combination to the desired physical address (serial number LS093221000019451JM5)

Target-only mapping using WWPN addressing

Use the following procedure to map iSCSI targets to storage devices by physical storage address.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target pegasus_email wwpn 22000020371912da

Specify desired SCSI routing instance (zeus). Specify iSCSI target (pegasus_email), and map it to the desired physical address (WWPN 22000020371912da) and any LUNs available as part of that WWPN.

Use the following procedure to map iSCSI targets to storage devices by index numbers.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target pegasus_email wwpn #?

Specify desired SCSI routing instance (zeus). Specify iSCSI target (pegasus_email), and prompt for an indexed list of available storage addresses using the number sign and a question mark (#?).

Step 3

scsirouter zeus target pegasus_email wwpn #4

Choose a physical address designated by an index number (see index number 4 in Example 6-2) to map the iSCSI target (pegasus_email) to desired physical address (WWPN 22000020371912da).

Creating and Configuring an Access List

Creating an access list consists of naming the new list. Configuring an access list consists of identifying the IP hosts that have permission to access storage devices via iSCSI target names.

IP hosts can be identified by:

•IP address

•CHAP user name (used for iSCSI authentication)

•iSCSI Name of the IP host - The iSCSI Name is a UTF-8 character string based on iSCSI functional requirements. It is a location-independent permanent identifier for an iSCSI node. An iSCSI node can be an initiator, a target, or both.

An access list can contain one or more types of identification entries. If an identification entry type exists in the access list, an IP host attempting to access the associated storage target must have a matching entry defined in the access list. For example, if an access list contains both IP address and iSCSI Name identification entry types, then every IP host that requires access to the associated set of storage resources must have a matching IP address and iSCSI Name entry in the access list.

An access list is necessary if you want to specify access to iSCSI targets on a per-IP host basis. An access list is not necessary if you want to specify that any IP host can have access to the iSCSI targets configured in a SCSI routing instance; however, in this case you must still configure access as described in Configuring Access to iSCSI Targets.

Note For each SN 5428 Storage Router, you can create a maximum of 100 access lists and configure up to 200 identification entries across all access lists.

Note If there is a CHAP user name entry in the access list, the SCSI routing instance used to access the storage target must also have iSCSI authentication enabled. See "Configuring Authentication," for additional information about AAA and iSCSI authentication.

Use the following procedure to create an access list. In this procedure, the access list is called aegis and the IP host identifiers include three IP addresses (10.2.0.23, 10.3.0.36, and 10.4.0.49) and three CHAP user names (12h7b.lab2.webservices, 36a8g.lab1.webservices, and 52a3c.lab2.webservices).

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

accesslist aegis

Create an access list by naming it (aegis). There is a 31 character limit.

Step 3

accesslist aegis description "Access to zeus SCSI routing service"

(Optional) Add a string as a description for the access list. Enclose the string using single or double quotes.

Step 4

accesslist aegis 10.2.0.23/32 10.3.0.36/32 10.4.0.49/32

Add IP addresses of IP hosts to the access list. Separate multiple IP addresses with a space. To limit the access to each specific IP address, set the subnet mask to 255.255.255.255. In this example, the subnet mask was set using CIDR style (/32).

Step 5

accesslist aegis chap-username 12h7b.lab2.webservices

accesslist aegis chap-username 36a8g.lab1.webservices

accesslist aegis chap-username 52a3c.lab2.webservices

Add CHAP user names to the access list. In this example, each IP host has a unique CHAP user name.

Note When using CHAP user names in an access list, iSCSI authentication must be enabled for the SCSI routing instance, and the IP host must be successfully authenticated using the configured AAA methods.

Note Access lists are cluster elements and, in a cluster environment, all access list management functions are handled by a single storage router. If you issue accesslist commands from another storage router in the cluster, the CLI displays an informational message with the name of the storage router that is currently handling those functions. See "Maintaining and Managing the SN 5428 Storage Router," for more information on operating the SN 5428 in a cluster.

Configuring Access to iSCSI Targets

Configuring access to iSCSI targets consists of associating a named access list to an iSCSI target to control target access on a per-IP host basis. The default for access to newly configured iSCSI targets is none. You must configure access to iSCSI targets according to the information provided in this section.

When configuring access, you can specify one iSCSI target at a time or all iSCSI targets associated with a SCSI routing instance, and you can specify a named access list or allow access by any IP host using a SCSI routing instance. In addition, you can deny access to iSCSI targets one at a time or all at once.

You can also associate up to two access lists with an iSCSI target: one allowing read/write access, and one allowing read-only access. The default access is read/write. Access lists are evaluated read/write first, and then read-only, so if an IP host is associated with both types of lists, it will be allowed read/write access.

Note Some host operating systems impose restrictions on the use of read-only access lists. For details, see the readme files and release notes for your IP host operating system.

Use the procedures that follow according to the type of access:

•Configuring access to one iSCSI target at a time

•Configuring access to all iSCSI targets at once

•Denying access to one or more iSCSI targets

•Configuring read/write and read-only access

Configuring access to one iSCSI target at a time

This section provides two procedures: one for configuring access to an iSCSI target by specific IP hosts, and one for configuring access to an iSCSI target by any iSCSI host.

Use the following procedure to configure access to one iSCSI target on a per-IP host basis by associating the iSCSI target with a named access list.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target chimaera_apps accesslist aegis

Specify that an iSCSI target (chimaera_apps), configured as part of a SCSI routing instance (zeus), can only be accessed by IP hosts listed in an access list (aegis). Because access is read/write by default, it does not need to be specified.

Use the following procedure to configure access to one iSCSI target by any iSCSI host.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target pegasus_email accesslist any

Specify that an iSCSI target (pegasus_email), configured as part of a SCSI routing instance (zeus), can be accessed by any IP host. Because access is read/write by default, it does not need to be specified.

Configuring access to all iSCSI targets at once

This section provides two procedures: one for configuring access to all iSCSI targets by specific IP hosts, and one for configuring access to all iSCSI targets by any IP host.

Use the following procedure to configure access to all iSCSI targets associated with a SCSI routing instance. Access is controlled on a per-IP host basis by associating the iSCSI targets with a named access list.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target all accesslist aegis

Specify that all iSCSI targets that were configured as part of the specified SCSI routing instance (zeus) can be accessed by IP hosts listed in an access list (aegis). Because access is read/write by default, it does not need to be specified.

Use the following procedure to configure access to all iSCSI targets associated with a SCSI routing instance. Access is open; the iSCSI targets are made available to any IP host.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target all accesslist any

Specify that all iSCSI targets that were configured as part of the specified SCSI routing instance (zeus) can be accessed by any IP host. Because access is read/write by default, it does not need to be specified.

Denying access to one or more iSCSI targets

This section provides two procedures: one for denying access to one iSCSI target at a time, and one for denying access to all iSCSI targets configured as party of a specified SCSI routing instance.

Use the following procedure to deny access to one iSCSI target by any IP host.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target chimaera_eng accesslist none

Specify that no IP host can access the iSCSI target (chimaera_eng), configured as part of the specified SCSI routing instance (zeus).

Use the following procedure to deny access to all iSCSI targets associated with a SCSI routing instance by any IP host.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target all accesslist none

Specify that no IP hosts can access any iSCSI targets that were configured as part of the specified SCSI routing instance (zeus).

Configuring read/write and read-only access

This section provides two procedures for applying read/write and read-only access to iSCSI targets, but there are many other combinations you can use.

Use the following procedure to assign read/write access to an iSCSI target by IP hosts listed in a named access list, and to assign read-only access to the same target by any other IP hosts.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target chimaera_eng accesslist aegis rw

Assign read/write access to the iSCSI target (chimaera_eng) by IP hosts listed in the access list (aegis).

Step 3

scsirouter zeus target chimaera_eng accesslist any ro

Assign read-only access to the iSCSI target (chimaera_eng) by any other IP hosts with access to that target.

Use the following procedure to specify that the IP hosts listed in one named access list have read/write access to an iSCSI target, and the IP host listed in another named access list has read-only access to the same target.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

scsirouter zeus target chimaera_eng accesslist aegis rw

Assign read/write access to the iSCSI target (chimaera_eng) by the IP hosts listed in the access list (aegis).

Step 3

scsirouter zeus target chimaera_eng accesslist medea ro

Assign read-only access to the iSCSI target (chimaera_eng) by the IP host listed in the access list (medea).

Verifying and Saving Configuration

Verify the access list configuration and the SCSI routing configuration using the procedures that follow. You can save the configuration at any time by using the save all bootconfig command. You must save the running configuration to the bootable configuration for it to be retained in the storage router when it is rebooted. Once you have saved the configuration, you can verify that the configuration to be used when the storage router is rebooted matches the currently running configuration.

In a cluster environment, saving the configuration makes the SCSI routing instance and access list information available to other storage routers in the cluster.

Use the following procedure to verify access list configuration.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

show accesslist

Display a list of all existing access lists (Example 6-4).

Step 3

show accesslist aegis

Display the IP hosts identified in an access list (Example 6-5).

Example 6-4 Verifying Existence of an Access List
[SN5428]# show accesslist
aegis
mars
medea
Example 6-5 Verifying IP Hosts in an Access List Named aegis
[SN5428]# show accesslist aegis
accesslist aegis description "Access to zeus SCSI routing service"
accesslist aegis 10.2.0.23/255.255.255.255
accesslist aegis 10.3.0.36/255.255.255.255
accesslist aegis 10.4.0.49/255.255.255.255
accesslist aegis chap-username 12h7b.lab2.webservices
accesslist aegis chap-username 36a8g.lab1.webservices
accesslist aegis chap-username 52a3c.lab2.webservices
Use the following procedure to verify the configuration of a SCSI routing instance.

Command

Description

Step 1

enable

Enter Administrator mode.

Step 2

show scsirouter zeus

Display the parameters configured for the specified SCSI routing instance (Example 6-6).

Example 6-6 Verifying Configuration for a SCSI Routing Instance
[SN5428]# show scsirouter zeus
SCSI Router Information
Status Codes: A=active, I=inactive, C=create failed, D=not enabled, S=slave
                          CDB   Reserve  Pass Lun
Router               Stat Retry Proxy    Thru Reset Description
-------------------- ---- ----- -------- ---- ----- -----------
zeus                 A    30    disabled no   no    (not set)
 
SCSI Router Authentication Information
Router               Authentication  Username        Password
-------------------- --------------- --------------- --------
zeus                 none            none            none
 
Router     ServerIf   Vlan Vid IP/Netmask                       Secondary  TCP P
---------- ---------- -------- -------------------------------- ---------- -----
zeus       ge2                 10.1.50.51/24                    none       3260N
 
Target Attribute Information
                                     Accesslist Accesslist
Router     Target           Status   Read-Write Read-Only  Profile CRC        Description
---------- ---------------- -------- ---------- ---------- ------- ---------- -----------
zeus       chimaera_apps    enabled  aegis      none       High    prefer-off (not set)
zeus       chimaera_eng     enabled  aegis      medea      High    prefer-off (not set)
zeus       pegasus_web      enabled  none       none       High    prefer-off (not set)
zeus       pegasus_email    enabled  none       none       High    prefer-off (not set)
 
Target Mapping Information
Router     Target           Mapping    iSCSI Name
---------- ---------------- ---------- -----------
zeus       chimaera_apps    Lun-wwpn   iqn.1987-05.com.cisco:00.e732a9ff858f.chimaera_apps
zeus       chimaera_apps    Lun-wwpn   iqn.1987-05.com.cisco:00.1579a736f6ea.chimaera_apps
zeus       chimaera_eng     Lun-lunid  iqn.1987-05.com.cisco:00.0857b0b9cacf.chimaera_apps
zeus       pegasus_web      Lun-serial iqn.1987-05.com.cisco:00.2d3a2d118fe1.chimaera_apps
zeus       pegasus_email    Tgt        iqn.1987-05.com.cisco:00.4131e05d05a8.chimaera_apps
 
Targets - Lun Mapped via WWPN
Router     Target           Lun   WWPN Primary     Lun   WWPN Secondary   Lun  
---------- ---------------- ----- ---------------- ----- ---------------- -----
zeus       chimaera_apps    24    2200002037559b0e 0 
 
Targets - Lun Mapped via Lunid
Router    Target            Lun   Lunid
---------- ---------------- ----- ----------------
zeus       chimaera_eng     17    200000203719129d
 
Targets - Lun Mapped via Serial
Router     Target           Lun   Serial
---------- ---------------- ----- ----------------
zeus       pegasus_web      3     LS093221000019451JM5