iscsi Protocols iscsi, Naming & Discovery, Boot, MIBs John Hufferd, Sr. Technical Staff IBM SSG

Transcription

1 iscsi Protocols iscsi, Naming & Discovery, Boot, MIBs John Hufferd, Sr. Technical Staff IBM SSG What is iscsi? iscsi is a transport protocol for SCSI that operates on top of TCP through encapsulation of SCSI commands in a TCP/IP stream. Enables the transport of I/O Block data over IP Networks. Ethernet Header IP Header TCP Header ISCSI Header ISCSI Data Ethernet Trailer TCP segment IP datagram Ethernet frame 19 June

2 What is iscsi? cont. iscsi s Protocol currently at version 8 soon version 9 This is the base encapsulation protocol isns Internet Storage Name Service Protocol Document A protocol for discovering storage devices A iscsi Bootstrapping Document Allows clients to boot from iscsi devices SW vrsnrequires a pre-boot execution environments (PXE). HW vrsn should boot like an normal SCSI HBA A SLP in Discovery Document An iscsi Security Document A iscsi MIB Document All documents and more information can be found at: 19 June What is iscsi? - cont. iscsi is a Transport for SCSI Commands iscsi is an End to End protocol iscsi can be implemented on Desktops, Laptops and Servers iscsi can be implemented with current TCP/IP Stacks iscsi can be implemented completely in a HBA iscsi has the concept of Human readable SCSI Device (Node) naming iscsi Transport includes Security as a base concept IPSec Connection Security iscsi Authentication for Access Control iscsi defines Discovery as a basic element iscsi define process for remote Boot, as a basic element iscsi defines MIB standards as a basic element 19 June

3 iscsi & SCSI Layering SCSI Host connection to SCSI target via iscsi Transport 19 June SCSI - a Client/Server Model Logical Unit Application Client Device Service Request Device Service Response Device Server Task Management Request Task Management Response Task Manager Initiator Target Host bus adapter is the SCSI initiator Target devices are the SCSI targets Initiators and target connected via an arbitrated shared bus. Limited target connectivity Limited initiator connectivity 19 June

4 iscsi - Layered Model Application Layer Application I/O Request Logical Unit SCSI Interface SCSI Layer SCSI Class Driver (SCSI Initiator) SCSI Application Protocol SCSI Device (SCSI Target) SCSI CDB iscsi Protocol Layer TCP/IP iscsi Protocol Services TCP/IP TCP/IP TCP/IP Interface iscsi Transport Interface TCP/IP Protocol iscsi session iscsi Protocol Services TCP/IP TCP/IP TCP/IP iscsi PDU TCP segments in IP Datagrams Ethernet Data link + Physical Ethernet Data link + Physical Ethernet Frame Replaces shared bus with switched fabric Transparently encapsulates SCSI CDBs Unlimited target and initiator connectivity 19 June iscsi Message Types Initiator to Target NOP-out SCSI Command Encapsulates a SCSI CDB SCSI Task Management Command Login Command Text Command SCSI data Output Data for Writes Logout Command SendTargets Used in iscsi Discovery Target to Initiator NOP-in SCSI Response Can contain status SCSI Task Management Response Login Response Text Response SCSI data Input Data from Reads Logout Response Ready to Transfer R2T Async Event 19 June

5 iscsi Session Establishment iscsi has the concept of a Session A session maybe made up of one or more TCP/IP connections for additional bandwidth The Session can be thought of as a SCSI Port Session has four phases/stages Initial login phase Security Authentication Phase Operational Negotiation Phase Full Featured Phase The Session can handle SCSI commands and data after Login is complete That is the Full Featured Phase 19 June iscsi Session Establishment Login begins with the first connection Text Strings are exchanged that define the parameters of the session Initial Login Phase Initiator Sends Login with Text Strings for InitiatorName, TargetName, and Authentication Options (which are then selected by Target) Security Authentication Phase Authentication Text exchanges (ID, Password, Certificates, etc.) Operational Negotiation Phase Each Side (Initiator and Target) negotiate the supported options all via Keyword=value, or Keyword=value,value,value Amount of unsolicited buffer Types of Data Delivery Solicited, unsolicited, immediate etc. Full Featured Phase can carry SCSI CDBs/Data, Task Management, and responses Similar process on parallel connection within the Session 19 June

6 iscsi Session Termination Session may end with Logout, or I/O error causing dropped connection But often connection can be reestablished and Session continued 19 June iscsi Security/Integrity Considerations A basic level of end to end data integrity can be reasonably handled by TCP using the standard checksum Two Types of Security and Integrity IPSec Secures TCP/IP Nodes; setup at TCP/IP startup -- before iscsi Login Session Authentication via IKE (Internet Key Exchange) Packet by Packet Authentication (also provides Integrity) Privacy via Encryption (also provide Integrity) iscsi Techniques (done/setup during iscsi Login) Authentication (ensures Nodes are authorized to use the iscsi Target Node) May use SRP, Chap, or Kerberos iscsi CRC32c Digest checks for Integrity beyond TCP/IP XOR CkSum Various levels of security fit each topology. Examples => Secure Main Floor -- No Security Campus LAN -- iscsi Authentication and CRC32c Remote Private WAN -- IPSec with Session/Packet Authentication Remote Internet WAN -- IPSec with Privacy Encryption 19 June

7 iscsi Key Points Sessions: iscsi Session = a group of TCP connections linking an initiator with a target ( i.e. can be one or more connections) Note: A TCP connection that is part of an iscsi session will only be used to carry iscsi traffic The iscsi initiator and target use this session for communicating iscsi commands, control messages, parameters, and data to each other TCP connections can be added and removed from a session using the iscsi Login / Logout commands 19 June iscsi Key Points (cont.) Connection Allegiance: For SCSI commands that require data and/or parameter transfer, the (optional) data phase and status phase must be sent over the same TCP connection that was used to deliver the SCSI command during the command phase Consecutive commands that are part of a SCSI task (i.e. a linked set of commands) MAY use different connections within the session Connection allegiance is strictly per-command and not per-task 19 June

8 iscsi Key Points (cont.) Tasks: A linked set of SCSI commands One and only one SCSI command at a time can be outstanding within any given iscsi task Initiator Task Tags(ITT)&Target Task Tags(TTT) Initiator tags for all pending commands must be unique initiator-wide SCSI Data packets are matched to their corresponding SCSI commands by using Tags that are specified in the protocol ITT for Unsolicited Data TTT (Target Transfer Tag) for Solicited Data 19 June iscsi Key Points (cont.) Solicited or Unsolicited Messages: Initiator to Target User data or command parameters will be sent as either Solicited data or Unsolicited data Solicited data is sent in response to Ready To Transfer (R2T) PDUs Unsolicited data can be part of an iscsi command PDU ( Immediate data") or an iscsi data PDU The maximum size of an individual data PDU or the immediate-part of the initial unsolicited burst MAY be negotiated at login Target to Initiator Targets sends Ready to Transfer (R2T) Message to Initiator, requesting data for Write Command Targets send Command Responses Targets sends Asynchronous Messages (SCSI & iscsi) Describing some Unusual or Error event 19 June

9 iscsi Protocol Data Unit (PDU) An Encapsulation Data Unit which carry SCSI information. Has Header Section and Data Section Additional Header Sections can also be used for Extended SCSI commands (third party Copy, etc.) Contains the SCSI CDB & the appropriate LUN Sequence Nums used for Flow Control and Sync Command Seq. Num. & Response Seq Num Header and Data Sections can have their own CRC32c Digest protection. Provides more protection then TCP/IP XOR Cksum 19 June iscsi PDU for a SCSI Command BYTE Bit 1 Bit X I Opcode F R W 0 0 ATTR Reserved CRN or 0x01 Reserved Total AHS Length Data Segment Length 2 Bit Logical Unit Number (LUN) Initiator Task Tag (ITT) Expected Data Transfer Length Command Seq. Num. (CmdSN) Expected Status Seq Num. (ExpStatSN) Bit SCSI Command Descriptor Block (CDB) or null 48 or nn Header Digest (if Any) -- CRC32c Data-Segment - Command Data 19 June

10 iscsi Key Points (cont.) Numbering: iscsi uses Command and Status Numbering Command numbering session wide and is used for ordered command delivery over multiple connections with in a session. It can also be used as a mechanism for command flow control over a session Status numbering per connection and is used to enable recovery in case of connection failure Fields in the iscsi PDUs communicate the reference numbers between the initiator and target. During periods when traffic on a connection is unidirectional, iscsi NOP-message PDUs may be utilized to synchronize the command and status ordering counters of the target and initiator 19 June iscsi READ Command Simplest Form: Step #1: Initiator transmits iscsi command PDU (CDB = Read) Step #2: Target transmits iscsi data-in PDU(s) Step #3: Target sends iscsi response PDU Notes: Solicited data via Read Command PDU (Initiator requests data from the target) The target can satisfy the single read command with multiple iscsi data read PDUs (PDUs can be out of order) The command is not complete until all data and status is received by initiator Good Status can be sent within the last iscsi data-in PDU All iscsi data-in PDUs and the response PDU will be delivered on the same TCP connection that the command was sent on All Data-in PDUs will carry the same value for the ITT field 19 June

11 What is Familiar & New About iscsi iscsi protocols can be exported fully onto the HBA (Like FC) Expect the same Host overheads as Fibre Channel Performance as good as FC when ASICs used for TCP/IP Offload Engine (TOE) The SCSI device driver might be the iscsi HBA Device Driver Like the FC Device Driver Most of the rest of the OS is unchanged Exception: Management Interfaces may or may not be same Vendor Dependent 19 June What is Familiar & New About iscsi Different types of iscsi targets are possible iscsi Target could be a gateway to SCSI or FC iscsi Target could be FC/iSCSI Switch/Router iscsi Target could be a RAID array with the upper interface iscsi iscsi Target could be a new virtualizing device iscsi Target could be a Tape Drive, Tape Lib, or Virtual Tape System 19 June

12 What is Familiar & New About iscsi iscsi has a set of approaches to discovery For small Networks Static Config, Init.s & Targets SendTargets Cmd makes configuration easer For Med Size Networks needing only simple Discovery Service Location Protocol (SLP Multicast Discovery) For Large Size Networks isns (internet Storage Name Service) Includes Soft Zone Domains Includes Database for ongoing management 19 June iscsi Names & Addresses iscsi NAME and Address in URL form <Domain-Name>[:<port>]/<iSCSI-name> DN => <= IPv4 DN => [af24:256b:12a4:247d:3478:ae3b:7539:7adc5]<= IPv6 DN =>Fully-Qualified-Domain-Name =>FQDN FQDN=> host1.almaden.ibm.com iscsi-name => either an iqn (iscsi Qualified Name) or eui (EUI- 64 name used in FC) iqn=>iqn.yyyy-mm.reverse-fqdn-[:.]-and-qualifier-string eui=>eui:eui-64bit-wwn Examples: iqn com.ibm.ssg.snj:aix.cluster1.mbr2 eui: a425678d iscsi full name and address expressed as a URL Example: portal3.mbr2.aix.snj.ibm.com[5000]/iqn com.ibm.snj:aix.mbr [3000]/eui A425678D 19 June

13 iscsi Architectural Model Network Entity (iscsi Client) --The OS -- iscsi Initiator Node Name=iqn com.ajax.OS1 iscsi (SCSI) Initiator Port Name=iqn com.ajax.os1[ISID=1] HBA with 2 Network Portals Portal Group Network Portal Portal Group A-1 IP Network Portal Group B-1 Portal Group A-2 Network Portal port 3000 Network Portal port 3000 Port 5000 HBA with 2 Network Portals port port 5000 HBA Network Portal port 5000 SCSI Device (A) iscsi (SCSI) Target Port eui a425678a[tag=2] iscsi (SCSI) Target Port eui a425678a[tag=1] iscsi Target Node (A) Name=eui A425678A Network Entity (iscsi Server) iscsi (SCSI)Target Port iqn com.ibm.ssg.12579[tag=1] iscsi Target Node ( B) Name=iqn com.ibm.ssg SCSI Device (B) 19 June Discovery & Configuration Static configuration Admin sets authorized iscsi Target Node Name, & iscsi Address Can receive a "Target has Moved" Redirect Response Admin can set iscsi Address of Specific Discovery Device, or to any valid iscsi portal at a Target Establish Discovery Session (only permits SendTargets in FFP) Use SendTargets command to get list of known targets Returned iscsi Target Node Names IP Addresses and Ports for each Node Name Get Portal Group Tag to identify Multi Connection Sessions portals Must, at least return all authorized portals within the Target Can be used for single admin location/device for simple networks If it contains information from many different iscsi Targets 19 June

14 Discovery & Configuration SendTargets Command Response A List of Target Names followed by Target IP address TargetName=<iSCSI-Target-Node-Name> TargetAddress<FQDN IP-Address>[:<port>],<portal-group-tag> For each Target Node Name there are n Target Address Portal Group Tags are used to associate IP address for use with Multiple Connection Sessions and identify the SCSI Port Name Example of SendTargets Command Response iqn com.ibm.ssg [5000], [5000], [3000], [5000],1 eui a425678a [3000], [5000], [3000],1 19 June Discovery & Configuration Dynamic configuration via Initiator use of SLP to find Targets iscsi controllers can register iscsi Node Name, iscsi Address, Portal Groups Admin can define which Targets should be accessed by which Hosts Initiators can query to get information Information returned will depend on Admin settings Specific Hosts will only have information returned that is appropriate for it Admin still tells Targets what Initiators are permitted This is the base for iscsi Authentication 19 June

15 SLP General Model Registered Info iscsi Node name TCP/IP address Portal Group Tags User Agent (UA) Contacts SA or DA for Target information Server Agent (SA) Advertises info to DA May optionally carry info if DA not available Directory Agent(DA) Holds Advertisements from all SAs Returns information to UAs 19 June Discovery & Configuration- isns Functions Name Registration Service isns clients register their attributes and address, and can then dynamically obtain information about accessible storage devices Network Zoning and Login Control Service Zones map to target access control lists Network management appcation can monitor, create, and change Zones for isns clients Authorized clients create new Zones and add new Zone members State Change Notification Service Server notifies clients if a registered device changes status Server notifies clients if Zone membership changes Server notifies clients if devices added or removed Map FC devices to an iscsi image Seamless integration of legacy FC fabrics with iscsi networks OPEN Source for Clients and Server 19 June

16 iscsi Boot Static configuration information for Boot Admin sets authorized iscsi Node Name and iscsi Address, Optional LUN Default LUN is 0 Dynamic configuration via use of DHCP or SLP DHCP be used by Host to get an IP address DHCP can hold the iscsi Boot Service Option (Admin Set) May contain all that is needed to reach the Boot device May only contain iscsi Target Node Name, then use SLP to resolve to iscsi address W/O DHCP information, SLP can be used to find Boot "Service" The Boot load process The Admin. or DHCP or SLP can enable the access BootP is also possible as part of a SW two phase process HW HBA can act as a normal SCSI HBA for system BIOS use 19 June iscsi MIB Structure Information and Statistics on all the following Instance Target Initiator Session Target Portal Initiator Portal Access List Connection 19 June

17 iscsi Working Group iscsi: a specification from the IETF IP Storage working group for encapsulating SCSI command data blocks (CDB) in a TCP/IP byte stream The working group will cover: Issues new to iscsi (a result of using an IP transport) Management, including MIB definition(s) The working group will not cover Extensions to existing protocols (SCSI, TCP, IP, ). File system protocols. Environments where high data loss rates are acceptable. That is, protocols assume a reliable transport (TCP) SNIA IP Storage Forum -- Marketing Industry Assoc. 19 June Backup 19 June

18 Integrating FC and IP Networks FC JBOD: WWN=X, isc SI iscsi Name = abc iscsi TapeInitiator 2 FC Server: WWN=Y, Library 2 iscsi Name = xyz isns Server iscsi Tape Library 1 iscsi Server 1 IP Network FC JBOD: WWN = X FC Fabric FC-iSCSI Gateway FC Server: WWN = Y Integrating FC Fabrics: FC-iSCSI Router registers FC devices WWN and iscsi Name alias. Both iscsi and FC identities are stored in the isns server 19 June Integrating FC and IP Networks FC JBOD: WWN=X, iscsi iscsi Name = abc iscsi TapeInitiator 2 FC Server: WWN=Y, Library 2 iscsi Name = xyz isns Server Management Platform iscsi Tape Library 1 iscsi Server 1 IP Network FC JBOD: WWN = X FC Fabric FC-iSCSI Gateway FC Server: WWN = Y Management Platforms can view and manage both iscsi and FC devices by interacting with isns server 19 June

19 Integrating FC and IP Networks iscsi Tape Library 2 is C S I Initiator 2 FC JBOD: WWN=X, iscsi Name = abc FC Server: WWN=Y, iscsi Name = xyz isns Server iscsi Tape Library 1 iscsi Server 1 IP Network FC JBOD: WWN=X, iscsi Name = abc FC JBOD: WWN = X FC Fabric FC-iSCSI Gateway FC Server: WWN = Y Other FC fabrics can be joined over common IP network. Other gateways can discover open mapping by querying isns FC-iSCSI Gateway FC JBOD: WWN = X 19 June FC Fabric FC Server: WWN = Z 19