0

I have a cluster of CentOS servers that all connect to NAS devices via iSCSI. The most recent NAS I need to add is a LenovoEMC px4-400r. On this Lenovo NAS, when iSCSI is enabled, it is enabled on all network interfaces. On the Lenovo side, there is no way to disable iSCSI on only one network interface. This poses a problem for me, because I have a management network where I don't want iSCSI traffic.

The iSCSI VLANs are 10.100.100.0/24 and 10.100.101.0/24. The management VLAN is 10.50.55.0/24.

I first perform an iSCSI discovery.

# iscsiadm -m discovery -t st -p 10.100.100.16
10.100.100.16:3260,1 iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0
10.100.101.16:3260,1 iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0
10.50.55.16:3260,1 iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0

As you can see, it discovers the iSCSI target on all three networks. If I proceed as normal and log into these nodes, multipathd will use all three paths.

# iscsiadm -m node -l
Logging in to [iface: default, target: iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0, portal: 10.50.55.16,3260] (multiple)
Logging in to [iface: default, target: iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0, portal: 10.100.100.16,3260] (multiple)
Logging in to [iface: default, target: iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0, portal: 10.100.101.16,3260] (multiple)
Login to [iface: default, target: iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0, portal: 10.50.55.16,3260] successful.
Login to [iface: default, target: iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0, portal: 10.100.100.16,3260] successful.
Login to [iface: default, target: iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0, portal: 10.100.101.16,3260] successful.
# multipath -ll
mpathj (35005907fe5a778fb) dm-3 SCST_FIO,lun0
size=7.2T features='0' hwhandler='0' wp=rw
|-+- policy='round-robin 0' prio=1 status=enabled
| `- 4:0:0:0  sdc 8:32  active ready running
|-+- policy='round-robin 0' prio=1 status=active
| `- 9:0:0:0  sdt 65:48 active ready running
`-+- policy='round-robin 0' prio=1 status=enabled
  `- 10:0:0:0 sdu 65:64 active ready running

I looked into the possibility of blacklisting a path in multipath.conf, but I didn't see a way to blacklist paths, only entire devices. When I tried that, multipath wouldn't create paths for this NAS at all.

The most likely solution that I found, but can't get working, is to set the iSCSI session over the management network to "manual" login. I did this:

iscsiadm -m node -T iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0 -p 10.50.55.16 -o update -n node.startup -v manual

Then I logged out of that session and ensured the sessions on the iSCSI VLANs remained:

# iscsiadm -m node -u -T iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0 -p 10.50.55.16:3260
Logging out of session [sid: 9, target: iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0, portal: 10.50.55.16,3260]
Logout of [sid: 9, target: iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0, portal: 10.50.55.16,3260] successful.
# iscsiadm -m session
tcp: [10] 10.100.100.16:3260,1 iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0 (non-flash)
tcp: [11] 10.100.101.16:3260,1 iqn.2012-07.com.lenovoemc:storage.onapp-lenovo.lun0 (non-flash)

This works, but only temporarily until either of the following happens:

  • I log into more targets via iscsiadm -m node -l
  • The server is rebooted

Does anyone know of a good way to permanently block an iSCSI session to the same LUN?

0

One method that you could use is to add a iptables filter into your INPUT and OUTPUT firewall chains, as such (place as appropriate in your chains):

-A INPUT -s 10.50.55.0/24 -p tcp -m tcp --sport 3260 -j DROP
-A OUTPUT -d 10.50.55.0/24 -p tcp -m -tcp --dport 3260 -j DROP

This would be a minimal change and as such wouldn't prevent other computers on the management network from accessing the iSCSI LUNs. The only other method I can think of off the top of my head is to put a bridged server/firewall in front of the management interface for the NAS whose sole job is to filter iSCSI traffic there.

  • This crossed my mind, but I was hoping to avoid this because it doesn't seem like a very elegant solution. Between iscsiadm and multipathd, blocking an iSCSI path doesn't seem that outlandish. – Brad Johnson Jan 29 '18 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.