USING ISCSI AND VERITAS BACKUP EXEC 9.0 FOR WINDOWS SERVERS BENEFITS AND TEST CONFIGURATION

Transcription

1 WHITE PAPER Maximize Storage Networks with iscsi USING ISCSI AND VERITAS BACKUP EXEC 9.0 FOR WINDOWS SERVERS BENEFITS AND TEST CONFIGURATION For use with Windows 2000 VERITAS Software Corporation 03/05/2003 1

2 TABLE OF CONTENTS TABLE OF CONTENTS...2 Introduction...3 WHAT IS iscsi?...3 iscsi Integration with a Fibre Channel SAN...4 Software Drivers and TCP/IP Offload Engine (TOE) Adapters...4 HOW BACKUP EXEC USES iscsi...4 How iscsi is Different From Remote Backup...4 Benefits of Using iscsi with Backup Exec...5 Cost-Effectiveness...5 Ease of Management...5 TEST CONFIGURATION...6 Solution Components...7 Configurations and Requirements...7 VERITAS Backup Exec 9.0 for Windows Servers...7 Cisco SN 5428 Storage Router...8 QLogic SANblade 4000 Series 1 Gb iscsi HBA...8 Cisco iscsi Miniport Driver...8 CONSIDERATIONS...8 Standards...8 Software Drivers and Performance...8 NICs...9 SUMMARY...9 References...9 2

3 INTRODUCTION As applications continue to grow data and storage requirements at unprecedented rates, a majority of enterprises are seeking cost effective ways to both protect the data as well as minimizing the overall storage costs. Over the past three years storage area networks (SANs) have significantly contributed to these IT objectives by consolidating the data and the backups onto a centrally administered infrastructure, with a common sharing of highly redundant storage devices of both arrays and tape libraries. However the adoption of these SANs, has been limited, as both the underlying technologies and the skill set required to deploy SANs has been cost prohibitive for many smaller departmental server applications. The storage industry has created and ratified an Internet storage protocol to overcome these price, technology, and administration adoption barriers, especially for departmental level applications. This protocol is known as iscsi, and has been developed to transport block level storage data across an IP networking infrastructure, with either access to storage devices also hosted on IP, or as a translation protocol for accessing storage that is hosted on a Fibre Channel SAN. In either scenario, whether the storage is located on IP, or is being translated to a Fibre Channel SAN, this technology (iscsi) significantly lowers the investment cost of adding new servers to a SAN for both primary storage and back-up applications. With regards to backup solutions, VERITAS TM Backup Exec 9.0 for Windows Servers software allows administrators to leverage the benefits of iscsi, which is to simplify networking by KEY BENEFITS Improves opportunity to use excess network capacity Reduces risk by avoiding single point of failure Minimizes investment by leveraging current infrastructure Helps extend SAN distance, enabling centralized remote office backup. merging block and file data onto an existing single Ethernet infrastructure to improve the reliability, availability, and performance of the storage network. This combined solution reduces risks and delivers the opportunity for new levels of storage efficiency. Additionally, it helps remove a single point of failure that can exist for traditional data protection environments. This paper presents a tested backup solution that uses VERITAS Backup Exec 9.0 for Windows Servers software in a mixed iscsi and fibre channel (FC) environment. Servers connect to this environment using both technologies, and the library and tape drives connect using FC. The Cisco SN5428 departmental storage router was qualified for going between servers hosted on IP to the storage devices connected to a Fibre Channel SAN. WHAT IS iscsi? iscsi is a protocol for encapsulating SCSI packets in TCP and then routing the packets using IP. iscsi allows block-level storage data to be transported over widely used IP networks using proven SCSI commands. This approach enables data access from virtually anywhere that can be reached through the Internet, effectively eliminating the physical boundaries of the storage network. iscsi can integrate with FC-based SANs using a router. iscsi lets organizations use storage resources more efficiently, especially with storage devices that are already interconnected via a Fibre Channel SAN and that are viewed as cost prohibitive for less costly, less resource intensive servers. iscsi eliminates the departmental server connectivity barrier to these SANs by leveraging the low cost, high performance benefits of Ethernet network interface. Block data can be effectively sent out through these server interfaces with the IP encapsulation of SCSI and then translated through the SN5428 into a native Fibre Channel frame and then forwarded to the appropriate storage target because storage is no longer stranded behind servers that prevent its use by other systems or remote users. A large installed base of blocklevel, direct-attached storage devices can be accessed by multiple systems over an IP network. With iscsi, SANs can be built using traditional Ethernet networking technology. In this way, iscsi allows a broad, mainstream market to implement SANs cost-effectively, and allows the SANs to be managed using technologies that companies already support and understand (for example, SCSI, IP, Ethernet, SNMP, etc.). As a result, 3

4 organizations are immediately able to take advantage of the interoperability benefits of iscsi, TCP/IP, and Ethernet. iscsi INTEGRATION WITH A FIBRE CHANNEL SAN Currently available iscsi products extend the FC SAN, but do not replace it. A storage router allows servers using iscsi to connect to devices on an FC SAN. The Cisco SN5428 Router provides this capability, and is also an 8-port FC switch, allowing for simple construction of a small SAN, and/or interconnected SANs as the storage needs grow. SOFTWARE DRIVERS AND TCP/IP OFFLOAD ENGINE (TOE) ADAPTERS The TCP/IP protocol provides a reliable connection over long-distances, unreliable links, and complex routes. Managing this protocol in software is resource-intensive and consumes significant processing power at gigabit and faster Ethernet speeds. NICs that provide hardware acceleration for this process are known as TCP/IP Offload Engine adapters or TOE NICs. These TOE NICS offload the resource intensive TCP/IP processing overhead from the server CPU while offering near wire rate networking throughput across the Ethernet interface. TOE NICS eliminate the need for host processor cycles freeing up the host processor to perform application and file operations. If encryption (such as IPSEC) is necessary, hardware acceleration may give an even larger performance benefit. To make a server iscsi-aware requires either a dedicated iscsi HBA or a software solution for an existing NIC. Cisco has created an iscsi driver that can be used with a NIC to provide iscsi access. When used with a TOE NIC, this may provide a high-performance solution. Without a TOE NIC, software drivers may be an appropriate solution for some backup tasks, especially for servers that are otherwise idle during the backup window. Additionally, with software drivers you can use 100 megabit NICs if performance is not a concern. Dedicated iscsi HBAs, such as the QLogic SANblade 4000, provide a TOE for the performance benefits, and appear to the operating system as a SCSI adapter. This is a more straightforward approach for adding iscsi storage, similar to adding an HBA to connect to SCSI or FC-based storage. HOW BACKUP EXEC USES iscsi To a VERITAS Backup Exec software administrator, backup devices that are attached using iscsi and fibre channel look the same. In both cases, sharing a backup device between multiple servers requires the Backup Exec SAN Shared Storage Option to provide a common device and media database. No special configuration of libraries or drives is required for Backup Exec for either technology. While only Windows 2000 servers are supported for backup across iscsi at this time, FC-attached backup devices can be shared between iscsi-attached Windows 2000 servers and FC-attached Windows NT 4 servers. The backup solution described in this paper has not been tested with Windows Server HOW iscsi IS DIFFERENT FROM REMOTE BACKUP iscsi and remote (agent-based) backup are two methods for protecting a set of servers using the same infrastructure. For both iscsi and remote backups, the backup data is sent across a TCP/IP network, but the iscsi method avoids dependency upon a single server. In a remote backup solution, a single VERITAS Backup Exec server with a directly connected tape library backs up a group of protected servers in turn, using a backup agent on each. The backup of each protected server is dependent on this single Backup Exec server. However, in an iscsi solution, the VERITAS Backup Exec SAN Shared Storage Option provides a common device and media database for a shared storage device. The Backup Exec software, along with the Backup Exec SAN Shared Storage Option, runs independently on each protected server to back up directly to the shared tape library. A single server cannot become a bottleneck or a shared point of failure. In some circumstances, 4

5 administrators can use the existing SAN (with VERITAS Backup Exec software and its SAN Shared Storage Option) to extend the SAN via iscsi protocols, and enable centralized remote office backup. BENEFITS OF USING iscsi WITH BACKUP EXEC Cost-Effectiveness An iscsi SAN solution leverages the cost, performance, and commonly understood administration benefits of IP. This includes the use of existing switched and routed infrastructures and many of the advanced traffic management, network management, and security management features that are offered with these products. Long distance WAN links for remote backup can be more easily configured when the transport is all IP based, as offered by iscsi. This reduces the need for specialized gateways between Fibre Channel and the WAN transport. If bandwidth or resource sharing of the same infrastructure is a concern, a cost effective IP LAN can be added with iscsi as the storage protocol. This separate network offers the same benefits as LAN-free backup with as fibre channel iscsi offers an open system approach for storage networking across IP. This offers more choice for the customer in terms of choosing the best solution for their needs An iscsi SAN works with 100/1GB/10GB Ethernet. Ease of Management Investment in training can be minimal, since iscsi is based on familiar technologies of SCSI, Ethernet, and TCP/IP. Managing an iscsi network is easier since you can utilize the same network performance and management tools that are in place for managing an existing communications network. Reliability and availability are improved since there is no need to shut down a server to add storage to an iscsi SAN. After storage is added to the SAN, it is available to any SAN-attached server. iscsi is free from the device limits (15 connections) imposed by SCSI. iscsi will accelerate the integration of NAS with SAN as both file- and block-based data can run over the same infrastructure. The use of TCP/IP by iscsi enables you to create SANs that span geographically dispersed locations. 5

6 TEST CONFIGURATION The following illustration displays the tested and supported backup solution in which Backup Exec 9.0 software is used in a mixed iscsi and fibre channel environment. Servers are connected to this environment using both iscsi and fibre channel, and the library and tape drives are connected using fibre channel. A Cisco Storage Networking Router is used to connect the iscsi and fibre channel networks. The source data used in this test was on local disk, but both FC-attached and iscsi-attached primary storage could be added to this configuration for protection by the VERITAS Backup Exec 9.0 software. In the future, iscsi-attached libraries and tape drives should allow solutions with no fibre channel components. The tested iscsi backup solution for VERITAS Backup Exec 9.0 for Windows Servers 6

7 SOLUTION COMPONENTS Component Description Required Software Driver/Firmware Server 1: QLogic SANblade Gb iscsi HBA Server 2: Gigabit Ethernet NIC with Cisco iscsi Miniport Driver Server 3: QLogic SANblade Gb FC HBA Storage Router: Cisco SN 5428 Storage Router A 1 Gb iscsi host bus adapter, connecting to the LAN, but presenting iscsi storage devices to the server in much the same way that a SCSI or FC HBA would. A SCSI miniport driver running in conjunction with an existing NIC to present iscsi storage devices to the server as if they were SCSI devices. An Intel PRO/1000 F NIC was used for this test. A 2 Gb FC HBA that demonstrates the iscsi environment mixed with an existing FC environment. Provides an iscsi-to-fc router and an 8-port fibre channel switch. Backup Exec 9.0 Backup Exec SAN Shared Storage Option Windows 2000 Backup Exec 9.0 Backup Exec SAN Shared Storage Option Windows 2000 Backup Exec 9.0 Backup Exec SAN Shared Storage Option May be running Windows 2000 or Windows NT 4 Driver version Firmware version Driver version Driver version Firmware (BIOS) version 1.29 Firmware (BIOS) version K9 Tape Library: StorageTek L20 Library with Quantum SDLT320 Tape Drives Any tape library and FC-to- SCSI bridge combination certified for use with the Backup Exec SAN Shared Storage Option could be used in this solution. CONFIGURATIONS AND REQUIREMENTS This section presents some guidelines for avoiding the most commonly encountered problems. Consult the vendor for each component for more appropriate technical help in the field. VERITAS Backup Exec 9.0 for Windows Servers The Backup Exec software requires no special configuration for use with iscsi; however, in order to share a tape or library device between multiple servers, the Backup Exec SAN Shared Storage Option must be installed on each server. ISCSI-attached backup devices are only supported with Windows 2000 at this time, but backup devices may be shared between iscsi-attached Windows 2000 servers and FC-attached Windows NT 4 servers. Note the following: Before installing the VERITAS Backup Exec software, complete the configuration of all iscsi components so that the storage devices are visible to the operating system. For servers using the Cisco iscsi driver, enable the Early Boot option for that driver in order for the Backup Exec software to be aware of all tape and library devices. 7

8 Cisco SN 5428 Storage Router Configuration of the Cisco 5428 needs to be appropriately configured for both IP server hosting, and Fibre Channel storage attachments. As part of the configuration of the Cisco 5428, you must do the following: The management port of the 5428 must be on a different subnet than the SCSI router. For a storage device to be seen by a server, the fibre channel device must be configured as a target within a SCSI router instance, each LUN for that device must be mapped to an iscsi LUN, and the server must be in the access control list for that target. On the Configure Reserve Proxy page for the SCSI router instance, the options Enable reserve proxy and Enable passthrough must be selected for the router to function properly with the VERITAS Backup Exec software. QLogic SANblade 4000 Series 1 Gb iscsi HBA This HBA is configured using the SANblade Control IX for Windows management software. Follow the instructions from QLogic for installing the HBA, driver, management software, and initial configuration of the QLA4000. If the QLA4000 cannot discover the storage devices behind the Cisco 5428, the following steps may be helpful: 1. On the HBA Options tab of the SANblade Control software, verify the network information assigned to the QLA On the Target Settings tab of the SANblade Control software, verify the IP address of the Cisco From the command line of the Cisco 5428, verify that the IP address of the QLA4000 can be pinged. 4. Check the access list for the target within the SCSI router entry in the Cisco From the SANblade Control application on the server, verify that the tape and library devices are visible. If a library device appears in SANblade control, but appears in the Windows Device Manager with a yellow! emblem, it may be necessary to uninstall the device from Windows Device Manager and reboot in order for the device to be discovered properly. Cisco iscsi Miniport Driver This driver uses an existing NIC (with its normal driver) to present iscsi devices. The NIC should be configured normally to have network access to the Cisco The Cisco iscsi driver may then be installed. The installation process will place an iscsi Config icon in the control panel that is used to configure the driver. The Early Boot option must be enabled for the iscsi driver so that the Backup Exec software can recognize tape and library devices. If the storage devices are not visible, try the following steps: 1. In the iscsi Config window, verify the IP address of the Cisco 5428, and check that the IP address responds to a ping. 2. In the iscsi Config window, check the status display for error messages. 3. Observe the console of the Cisco 5428 for error messages while attempting to log in and rescan from the iscsi Config window. 4. Check the access list for the target within the SCSI router entry in the Cisco The Early Boot option, required for VERITAS Backup Exec, is not compatible with a DCHP-assigned IP address. A fixed IP address must be assigned to the NIC used for iscsi. CONSIDERATIONS Standards The devices in this test are compliant with revision 8 of the standard proposed by the Internet Engineering Task Force (IETF). Some or all of these devices may be non-compliant with the version of the specification that is adopted by the standards committee. Software Drivers and Performance The performance tradeoffs between software drivers and iscsi HBAs were previously discussed. However, special care should be taken when considering 100 MB NICs with software drivers. The maximum data rate available with these NICs may not be sufficient to stream high-end tape drives, resulting in dramatically reduced performance. 8

9 NICs There are a broad variety of NIC products available and VERITAS Software can make no representation that any specific NIC will work properly with the Cisco iscsi drivers. Although we currently know of no limitations in this area, use caution with devices that present a logical NIC, such as NIC teaming products, as it would not be surprising if problems develop when one virtual NIC is layered on another. SUMMARY IT organizations continually strive to bring new efficiencies in managing storage and protecting data, particularly where SANs are concerned. VERITAS Backup Exec 9.0 for Windows Servers software brings tested configurations to help IT administrators leverage iscsi to maximize their storage network. Indeed, IP networking has vast market size, and may prove to be the disruptive technology that will significantly reduce the cost of storage while simplifying the deployment and management of storage networking. iscsi will also accelerate the convergence of NAS and SAN architectures by enabling a single network to serve both file and block I/O traffic. IP-based storage networking has very little downside risk, and practically unlimited upside benefit for corporations to investigate this new technology. VERITAS Software is pleased to add this technology to the list of supported storage networking infrastructure. References Cisco SN 5428 Storage Router: QLogic FC HBA Products: QLogic iscsi HBA Products: VERITAS Backup Exec for Windows Servers device support list: iscsi Standard Working Group: VERITAS Software Corporation Corporate Headquarters 350 Ellis Street Mountain View, CA or For additional information about VERITAS Software, its products, or the location of an office near you, please call our corporate headquarters or visit our Web site at 9