iscsiadm enable management of iscsi initiators

Transcription

1 iscsiadm(1m) Name Synopsis Description iscsiadm enable management of iscsi initiators iscsiadm subcommand direct-object [options] [operand] The iscsiadm command enables management of the iscsi (Internet SCSI) initiator on a host. iscsiadm is implemented as a set of subcommands, many with their own options, which are described in the section for that subcommand. Options not associated with a particular subcommand are described under OPTIONS. iscsiadm works only when the following service is online: svc:/network/iscsi/initiator:default The iscsiadm command supports the following subcommands, which are described in detail in subsections that follow: add Adds element(s) to an object. list Lists element(s) of an object. modify Modifies attributes of an object. remove Removes an element from an object. The iscsiadm subcommands operate on a direct-object. These are described in the section for each subcommand. The iscsiadm command supports the Internet Storage Name Service (isns) for the discovery of iscsi targets. The command supports the Challenge Handshake Authentication Protocol (CHAP) for authentication. add Subcommand The syntax for the add subcommand is: # iscsiadm add direct_object [operands...] The add subcommand adds the following direct_objects: discovery-address discovery-address [...] Adds a target to a list of discovery addresses. A discovery address (as in the syntax shown below) is an IP address:port combination used in a SendTargets discovery session. Using this discovery approach, a target device can inform an initiator of the target address and target name of each target exposed by that device. Connection to a target is not attempted unless the SendTargets method of discovery has been enabled on the host. You enable this method with the modify subcommand. The discovery-address parameter is formatted as: <IP address>[:port] If port is not specified, the default of 3260 will be used. System Administration Commands - Part

2 iscsiadm(1m) isns-server isns-server [...] Add an isns server to the list of isns server addresses. An isns server address (specified in the syntax shown below) is an IP address-port combination used in an isns discovery session. By using isns discovery, an isns server can provide an initiator with information about a portal and the name of each target that belongs to the same discovery domain as that of the initiator. Connection to the isns server is not attempted unless the isns method of discovery has been enabled on the host. You enable this method with the modify subcommand, described below. The isns-server parameter is formatted as: IP_address[:port] If a port is not specified, the default of 3205 is used. static-config static_target [...] Adds a target to the list of statically configured targets. A connection to the target will not be attempted unless the static configuration method of discovery has been enabled. The static_target parameter is formatted as: <target-name>,<target address>[:port-number][,tpgt] <target-name> can be up to 223 characters. list Subcommand The syntax for the list subcommand is: # iscsiadm list direct-object [options] The list subcommand displays data for the following direct-objects: discovery Lists the discovery methods and their current activation state, enabled or disabled. Discovery methods are: isns (Internet Storage Name Service) Static SendTargets initiator-node Lists information for the initiator node on the host. The iscsi initiator node represents a logical HBA and is a logical host connection point for iscsi targets. The parameter values listed in the response are default parameter settings for the initiator. Each connected target for an initiator can have parameter values that differ from the parameter values on the initiator node. static-config [static_target[,...]] Lists the target name and address for specified targets or, if no static targets are specified, all statically discovered targets man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

3 iscsiadm(1m) target [-S][-v][target[,...]] Lists a target's current parameters, connection state, and which method was used for the target's discovery. Reports information for specified targets or, if no targets are specified, all targets that have been discovered or have had parameters modified by the modify target subcommand. When used with the -S option for a specified target, this subcommand returns: target name logical unit number vendor ID product ID OS device name (for example, /dev/rdsk/c0t2d0s0) The -v options gives more details, such as the current login parameters, the detailed connection information, and the discovery method used to discover the target. modify Subcommand A return of NA as the discovery method parameter indicates that the target was created with a iscsiadm modify target-param command and does not exist as a discovered object. To remove such targets, use iscsiadm remove target-param. target-param [-v] target [...] Lists a target's default and user-defined parameters. discovery-address [-v][discovery-address[,...]] Lists the discovery-address objects that have been added using the iscsiadm add discovery-address subcommand. When used with the -v option, lists all known targets at a specified discovery-address. The -v option returns one or more target names along with zero or more target addresses and associated target portal group tags (TPGT), if applicable. isns-server [-v][isns-server[,...]] Lists the isns-server objects that have been added using the iscsiadm add isns-server subcommand. When used with the -v option, this subcommand lists all known targets at a specified isns-server address. The -v option returns one of more target names along with zero or more target addresses and associated target portal group tags, if applicable. The syntax for the modify subcommand is: # iscsiadm modify direct_object [options] The modify subcommand supports the following direct_objects: discovery [options] Enabling a discovery method initiates a discovery using that method. Disabling a discovery method that is currently enabled does not affect connections to any targets that have already been discovered by that method. System Administration Commands - Part

4 iscsiadm(1m) Options for modify discovery are as follows: -i, -isns enable disable Enable or disable isns discovery. -s, --static enable disable Enable or disable static discovery. -t, --sendtargets enable disable Enable or disable SendTargets discovery. initiator-node [options] Modifies an initiator's properties. If a target is currently connected, this operation can succeed. However, the modified set of parameters will not be in effect for that target until an existing connection session no longer exists and a new connection has been established. The options -C and --CHAP-secret require a CHAP secret entry in response to a prompt. For iscsi booting when the Solaris I/O multipathing feature (formerly known as Sun StorEdge Traffic Manager [STMS] or MPxIO) is disabled, you can modify only the following initiator-node options: -r, --radius-server -R, --radius-access -P, --radius-shared-secret For iscsi booting when the Solaris I/O multipathing feature is enabled, you can modify only the following initiator-node options: -h, --headerdigest -d, --datadigest -c, --configured-sessions Options for modify initiator-node are as follows: -A, --node-alias <initiator node alias> Modifies the initiator node alias. Maximum length of 223 characters. -a, --authentication chap none Sets the authentication mode. -C, --CHAP-secret Sets the CHAP secret value. There is no default value. Maximum length is 16 characters; minimum required length is 12 characters. -c, --configured-sessions <num_sessions> <IP address>[,<ip address>...] Sets the number of configured iscsi sessions that will be created for each iscsi target. The feature should be used in combination with the Solaris I/O multipathing feature described in scsi_vhci(7d). -d, --datadigest none CRC32 Sets whether CRC32 is enabled to check SCSI data transfers man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

5 iscsiadm(1m) -H, --CHAP-name CHAP name Specifies a CHAP username. If you do not use this option, upon initialization, the CHAP name is set to the initiator node name. When the authentication method is set to CHAP (see -a/--authentication option, above), the CHAP username is displayed with the command iscsiadm list initiator-node. -h, --headerdigest none CRC32 Sets whether CRC32 is enabled to check SCSI packet headers. -m, --max-connections number_connections Modifies the maximum connection number for iscsi sessions. The default value is 1. The maximum number of connections for each session is N, --node-name <initiator node name> Modifies the initiator node name. Maximum of 223 characters. Note During Solaris installation, the initiator node name is set to a globally unique value. Changing this value can adversely affect operation within the iscsi network. -P, --radius-shared-secret (exclusive) Sets the RADIUS shared secret. -R, --radius-access enable disable Sets whether a RADIUS server will be used. -r, --radius-server <IP address>[:<port>] Sets the IP address and port of the radius server to be used. -T, --tunable-param <<tunable-prop>=<value>,...> Specify one or more tunable parameters for all targets that initiator node connected. Note These values should only be modified by an administrator with a good working knowledge of the parameter's impact within the iscsi network. Supported tunable-prop options are: recv-login-rsp-timeout Session Login Response Time The recv-login-rsp-timeout option specifies how long iscsi initiator will wait for the response of iscsi session login request from the iscsi target. Valid value is from 0 to 60*60, default to 60 seconds. conn-login-max Maximized Connection Retry Time The conn-login-max option lets the iscsi initiator reestablish the connection to the target in case of IO timeout or connection failure during the given time window. Valid value is from 0 to 60*60, default to 180 seconds. System Administration Commands - Part

6 iscsiadm(1m) polling-login-delay Login Retry Time Interval The polling-login-delay option specifies the time interval between each login retry when iscsi initiator to target IO timeout or connection failure. Valid value is from 0 to 60*60, default to 60 seconds. target-param [options] target Modifies a target's parameters. If a target is currently connected, the modify operation will succeed, although the modified settings might not take effect for a few seconds. To confirm that these settings are active, use iscsiadm list target -v. If a specified target is not associated with any discovery method, a target object is created with the specified parameters. After using this command to modify a target's parameters, the new parameters will persist until they are modified or removed with a iscsiadm remove target-param command on that target. The options -C and --CHAP-secret require a CHAP secret entry in response to a prompt. Options for modify target-param are as follows: -B, --bi-directional-authentication enable disable Sets the bidirectional option. If set to enable, the initiator performs bidirectional authentication for the specified target. -C, --CHAP-secret Sets the target's CHAP secret value. There is no default value. Maximum acceptable length is 16 characters. -c, --configured-sessions <num_sessions> <IP address>[,<ip address>...] Sets the number of configured iscsi sessions that will be created for each iscsi target. The feature should be used in combination with the Solaris I/O multipathing feature described in scsi_vhci(7d). -d, --datadigest none CRC32 Sets whether CRC32 is enabled or disabled for the data. -H, --CHAP-name CHAP name Sets a CHAP username. If you do not use this option, upon initialization, the CHAP name is set to the target name. When the authentication method is set to CHAP (see -a/--authentication option, under the initiator-node direct object, above), the CHAP username is displayed with the command iscsiadm list initiator-node. -h, --headerdigest none CRC32 Sets whether CRC32 is enabled or disabled for the header. -p, --login-param Specify one or more login parameter settings. Note These values should only be modified by an administrator with a good working knowledge of the parameter's impact within the iscsi network man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

7 iscsiadm(1m) The login parameters are derived from iscsi proposed standard RFC Valid values are: dataseqinorder yes or no defaulttime2retain defaulttime2wait firstburstlength 512 to immediatedata yes or no initialr2t yes or no maxburstlength 512 to datapduinorder yes or no maxoutstandingr2t 1 to maxrecvdataseglen 512 to T, --tunable-param <<tunable-prop>=<value>,...> Specify one or more tunable parameters for all targets that initiator node connected. Note Tunable values should only be modified by an administrator with a good working knowledge of the parameter's impact within the iscsi network. Supported tunable-prop options are: recv-login-rsp-timeout Session Login Response Time The recv-login-rsp-timeout option specifies how long iscsi initiator will wait for the response of iscsi session login request from the iscsi target. Valid value is from 0 to 60*60, default to 60 seconds. conn-login-max Maximized Connection Retry Time The conn-login-max option lets the iscsi initiator reestablish the connection to the target in case of IO timeout or connection failure during the given time window. Valid value is from 0 to 60*60, default to 180 seconds. polling-login-delay Login Retry Time Interval The polling-login-delay option specifies the time interval between each login retry when iscsi initiator to target IO timeout or connection failure. Valid value is from 0 to 60*60, default to 60 seconds. System Administration Commands - Part

8 iscsiadm(1m) remove Subcommand The syntax for the remove subcommand is: # iscsiadm remove direct_object The remove subcommand supports the following direct_objects: discovery-address discovery-address,... Removes a target device from the list of discovery addresses. A discovery address (as in the syntax shown below) is an IP address-port combination used in a SendTargets discovery session. Using this discovery approach, a target device can inform an initiator of the target address and target name of each target exposed by that device. If any target exposed by the discovery address is currently mounted or there is active I/O on the device, an error of logical unit in use is returned and the operation fails. If the associated devices are not in use, they are removed. discovery-address must be formatted as: <IP address>[:<port>] There are no options associated with this direct object. isns-server isns-server,... Removes an isns server from the list of isns server addresses. An isns server address (specified in the syntax shown below) is an IP address-port combination used in an isns discovery session. By using isns discovery, an isns server can provide an initiator with information about a portal and the name of each target that belongs to the same discovery domain as that of the initiator. If any target discovered by means of isns is currently mounted or there is active I/O on the device, an error of logical unit in use is returned and the operation fails. If the associated devices are not in use, they are removed. isns-server must be formatted as: IP_address[:port] There are no options associated with this direct object. static-config static_target,... Removes a target from the list of statically discovered targets. If the target being removed is currently mounted or there is active I/O on the device, an error of logical unit in use is returned and the operation fails. If a device is not in use, it will be removed. static_target must be formatted as: <target-name>,<target-address>[:port-number][,tpgt] There are no options associated with this direct object. target-param target-name Removes target specified by target-name. The target name is formatted as: <target-name> 1134 man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

9 iscsiadm(1m) Proper Use of Discovery Methods There are no options associated with this direct object. For iscsi booting when the Solaris I/O multipathing feature (formerly known as Sun StorEdge Traffic Manager [STMS] or MPxIO) is enabled, you cannot remove the target. Do not configure a target to be discovered by both static and dynamic discovery methods. The consequence of using redundant discovery methods might be slow performance when communicating with the iscsi target device. Options Examples The following generic options are supported: -V, --version Displays version information. Stops interpretation of subsequent arguments. -?, --help Displays help information. Can be used following an iscsiadm command with no arguments, following a subcommand, or following a subcommand-direct object combination. Responds with help information appropriate for your entry. For example, if you enter: # iscsiadm modify initiator-node --help...iscsiadm responds with a display of the options available for that combination of subcommand and direct object. EXAMPLE 1 Adding a Discovery Address The following command uses the add subcommand to add a discovery address. # iscsiadm add discovery-address : :3260 EXAMPLE 2 Adding a Static Target The following command uses the add subcommand to add a static target. # iscsiadm add static-config \ iqn com.array:sn , :3260 EXAMPLE 3 Listing Current Discovery Settings The following command uses the list subcommand to list current discovery settings. # iscsiadm list discovery Discovery: Static: enabled Send Targets: disabled isns: enabled EXAMPLE 4 Obtaining Verbose Discovery Output The following commands uses the -v option (one with, one without) with the list subcommand to obtain verbose output. System Administration Commands - Part

10 iscsiadm(1m) EXAMPLE 4 Obtaining Verbose Discovery Output (Continued) # iscsiadm list discovery-address Discovery Address: :3260 Discovery Address: :3260 # iscsiadm list discovery-address -v :3260 Discovery Address: :3260 Target name: eui d1f7 Target address: :3260 Target name: eui a693 Target address: :3260 EXAMPLE 5 Displaying Information on the Initiator The following command uses the list subcommand to display information on the initiator. # iscsiadm list initiator-node Initiator node name: iqn com.company.central.interopv20-1 Initiator node alias: interopv20-1 Login Parameters (Default/Configured): Header Digest: NONE/NONE Data Digest: NONE/NONE Authentication Type: CHAP CHAP Name: iqn com.company.central.interopv20-1 RADIUS Server: NONE RADIUS access: disabled Tunable Parameters (Default/Configured): Session Login Response Time: 60/- Maximum Connection Retry Time: 180/- Login Retry Time Interval: 60/- Configured Sessions: 1 EXAMPLE 6 Displaying Static Configuration Information The following command uses the list subcommand to display information about static configurations. # iscsiadm list static-config Static target: eui a693, :3260 EXAMPLE 7 Displaying Target Information The following commands show the use of the list subcommand with various options to display information about targets. # iscsiadm list target Target: iqn com.abcstorage:tgt-1 Alias: man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

11 iscsiadm(1m) EXAMPLE 7 Displaying Target Information (Continued) TPGT: ISID: a0000 Connections: 1# iscsiadm list target -v iqn com.abcstorage:tgt-1 Target: iqn com.abcstorage:tgt-1 Alias: - TPGT: ISID: a0000 Connections: 1 CID: 0 IP address (Local): :32803 IP address (Peer): :3260 Discovery Method: SendTargets Login Parameters (Negotiated): Data Sequence In Order: yes Data PDU In Order: yes Default Time To Retain: 20 Default Time To Wait: 2 Error Recovery Level: 0 First Burst Length: Immediate Data: yes Initial Ready To Transfer (R2T): yes Max Burst Length: Max Outstanding R2T: 1 Max Receive Data Segment Length: Max Connections: 1 Header Digest: NONE Data Digest: NONE # iscsiadm list target -S iqn com.abcstorage:tgt-1 Target: iqn com.abcstorage:tgt-1 Alias: - TPGT: ISID: a0000 Connections: 1 LUN: 6 Vendor: ABCStorage Product: iscsi Target OS Device Name: /dev/rdsk/c3t1d0s2 LUN: 5 Vendor: ABCStorage Product: iscsi Target OS Device Name: /dev/rdsk/c3t0d0s2 EXAMPLE 8 Displaying Target Parameter Information The following command uses the list subcommand to display target information for a specific target. System Administration Commands - Part

12 iscsiadm(1m) EXAMPLE 8 Displaying Target Parameter Information (Continued) # iscsiadm list target-param -v iqn com.abcstorage:tgt-1 Target: iqn com.abcstorage:tgt-1 Alias: - Bi-directional Authentication: disabled Authentication Type: NONE Login Parameters (Default/Configured): Data Sequence In Order: yes/- Data PDU In Order: yes/- Default Time To Retain: 20/- Default Time To Wait: 2/- Error Recovery Level: 0/- First Burst Length: 65536/- Immediate Data: yes/- Initial Ready To Transfer (R2T): yes/- Max Burst Length: /- Max Outstanding R2T: 1/- Max Receive Data Segment Length: 65536/- Max Connections: 1/- Header Digest: NONE/- Data Digest: NONE/- Tunable Parameters (Default/Configured): Session Login Response Time: 60/- Maximum Connection Retry Time: 180/- Login Retry Time Interval: 60/- Configured Sessions: 1 EXAMPLE 9 Enabling Static Discovery Method The following command uses the modify subcommand to enable the static discovery method. # iscsiadm modify discovery --static enable EXAMPLE 10 Setting the IP Address for the Radius Server The following command uses the modify subcommand to set the IP address for the radius server, which will be used for CHAP authentication. # iscsiadm modify initiator --radius-server EXAMPLE 11 Setting the Node Name for Initiator The following command uses the modify subcommand to set the node name for the initiator node. # iscsiadm modify initiator-node -N iqn com.sun.host man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

13 iscsiadm(1m) EXAMPLE 12 Setting Max Connections for the Initiator Node The following command uses the modify subcommand to set the max connection number for the initiator node. This enables multiple connections to exist in one session. # iscsiadm modify initiator-node -m 3 EXAMPLE 13 Changing Target Parameters The following command uses the modify subcommand to change the max connection number of the target parameters for a specified target. # iscsiadm modify target-param -m 3 eui a693 EXAMPLE 14 Removing a Discovery Address The following command uses the remove subcommand to remove a discovery address. # iscsiadm remove discovery-address :3260 EXAMPLE 15 Removing Target Parameters The following command uses the remove subcommand to remove a set of target parameters. # iscsiadm remove target-param eui a693 EXAMPLE 16 Modifying Maximum Connection Number The following command modifies the maximum number of connections for each session in the initiator's property. The modified value will be used in all sessions, to all targets. # iscsiadm modify initiator-node --max-connections 4 Attributes See attributes(5) for descriptions of the following attributes: ATTRIBUTETYPE ATTRIBUTEVALUE Availability Interface Stability system/storage/iscsi/iscsi-initiator Committed See Also attributes(5), iscsi(7d), scsi_vhci(7d) Oracle Solaris Administration: Devices and File Systems System Administration Commands - Part

14 itadm(1m) Name Synopsis Description itadm administer iscsi targets itadm create-target [-a,--auth-method radius chap none default] [-s,--chap-secret] [-S,--chap-secret-file path] [-u,--chap-user chap-user-name] [-n,--node-name target_node_name] [-l,--alias alias] [-t,--tpg tpg-name[,tpg-name]] itadm modify-target [-a,--auth-method radius chap none default] [-s,--chap-secret] [-S,--chap-secret-file path] [-u,--chap-user chap-user-name] [-n,--node-name new_target_node_name] [-l,--alias alias] [-t,--tpg tpg-name[,tpg-name]] target_node_name itadm delete-target [-f,--force] target_node_name itadm list-target [-v,--verbose] [target_node_name] itadm create-tpg tpg_name IP-address[:port] [IP-address[:port]]... itadm list-tpg [-v,--verbose] [tpg_name] itadm delete-tpg [-f,--force] tpg_name itadm create-initiator [-s,--chap-secret] [-S,--chap-secret-file path] [-u,--chap-user chap-user-name] initiator_node_name itadm modify-initiator [-s,--chap-secret] [-S,--chap-secret-file path] [-u,--chap-user chap-user-name] initiator_node_name itadm list-initiator [-v,--verbose] initiator_node_name itadm delete-initiator initiator_node_name itadm modify-defaults [-a,--auth-method radius chap none] [-r,--radius-server IP-address[:port]] [-d,--radius-secret] [-D,--radius-secret-file path][-i,--isns enable disable] [-I,--isns-server IP-address[:port][,IP-address[:port]]] itadm list-defaults The itadm command manages Internet SCSI (iscsi) target nodes within the SCSI Target Mode Framework described in stmfadm(1m) and libstmf(3lib). This allows the iscsi initiators to access STMF logical units using the iscsi protocol. In addition to iscsi target nodes, itadm manages two other classes of managed objects: iscsi Target Portal Groups, and iscsi Initiator Node Contexts. iscsitarget Portal Groups itadm is implemented as a set of subcommands with options and operands for each subcommand. These subcommands are described in their own section, below. In addition to its subcommands, itadm has a help command, which displays the utility's usage information. The help command is invoked with the -? option. An iscsi Target Network Portal is an IP address and TCP port that can be used by an initiator node to connect to an iscsi target. A collection of these portals is called a Target Portal Group (TPG). You can use a TPG to limit access to an iscsi target. Use the itadm modify -t 1150 man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

15 itadm(1m) iscsi Initiator Node Contexts Specifying IP Addresses Sub-commands itadm create-target command to bind a specific iscsi target to the TPG. An iscsi listener is created on each IP address that belongs to the TPG, and listens for connections to the iscsi target. A TPG is identified by a unique name provided when the TPG is created. A numerical Target Portal Group Tag from the range is automatically generated when the TPG is created. The Target Portal Group Tag 1 is reserved for the default target portal group that is used when no explicit Target Portal Groups are set on the target. The portal for the default TPG matches requests from all network interfaces on port Certain operations such as authentication by means of Challenge Handshake Authentication Protocol (CHAP) require parameters associated with a remote iscsi Initiator Node. These parameters are associated with an iscsi Initiator Node Context. An iscsi Initiator Node Context is identified by its Initiator Node Name, formatted in either IQN or EUI format (see RFC 3720). For example: iqn com.sun:01:e d55444 eui a425678d A number of itadm subcommands require that you specify one or more IP addresses with optional port numbers. For IPv4, use standard dotted decimal notation. For IPv6, enclose addresses in square brackets. The following are example specifications. IPv4: :3260 IPv6: [1080:0:0:0:8:800:200C:417A] [1080:0:0:0:8:800:200C:417A]:3260 The following are the itadm subcommands with their options. itadm create-target [-a,--auth-method radius chap none default] [-s,--chap-secret] [-S,--chap-secret-file path] [-u,--chap-user chap-user-name] [-n,--node-name target_node_name] [-l,--alias alias] [-t,--tpg tpg-name[,tpg-name,...]] Create a iscsi target with the specified options. Options are as follows. -a,--auth-method radius chap none default Specifies the authentication method to use for the target. Valid values are radius, chap, and none. chap indicates that initiators connecting to this target must be authenticated using the Challenge Handshake Authentication Protocol (CHAP). radius indicates initiators should also be authenticated by means of CHAP but the required authentication parameters should be obtained from a central RADIUS server (see the radius-server and radius-secret options). none means that no authentication is required to connect to the target. default means the target will use the global setting of this property. (See the modify-defaults subcommand.) -s,--chap-secret The CHAP secret to send during mutual CHAP authentication. There is no default for this property. Maximum length is 255 characters; minimum required length is 12 characters. System Administration Commands - Part

16 itadm(1m) -S,--chap-secret-file path Path to a temporary file containing the CHAP secret as described in the -s option. itadm modify-target -u,--chap-user chap-user-name Specifies the CHAP username for a target for use in mutual CHAP authentication. This value is allowed only for targets, cannot be set globally, and is used only when the initiator node is configured to use mutual CHAP authentication. If no value is specified then the target node name is used as the username. See iscsiadm(1m). -n,--node-name target_node_name An iscsi Target Node is identified by its Target Node Name, formatted in either IQN or EUI format (see RFC 3720). This option establishes that name. -l,--alias alias An alternate identifier associated with a target node. The identifier does not need to be unique. -t,--tpg tpg-name[,tpg-name,...] A list of Target Portal Group (TPG) identifiers that specifies the TPGs that an initiator can use to access a specific target or the keyword default. If default is specified, the target will use the default portal, INADDR_ANY:3260. itadm modify-target [-a,--auth-method radius chap none default] [-s,--chap-secret] [-S,--chap-secret-file path] [-u,--chap-user chap-user-name] [-n,--node-name new_tgt_node_name] [-l,--alias alias] [-t,--tpg tpg-name[,tpg-name]] target_node_name Modify an iscsi target according to the specified options. Options are as follows. -a,--auth-method radius chap none default As described under the create-target subcommand, above. -s,--chap-secret As described under the create-target subcommand, above. -S,--chap-secret-file path As described under the create-target subcommand, above. -u,--chap-user chap-user-name As described under the create-target subcommand, above. To remove an explicitly set CHAP username use -u none. -n,--node-name target_node_name Renames the target. See also the description of -n under the create-target subcommand, above. -l,--alias alias As described under the create-target subcommand, above. To remove an explicitly set alias use -l none man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

17 itadm(1m) -t,--tpg tpg-name[,tpg-name,...] As described under the create-target subcommand, above. itadm list-target itadm list-target [-v,--verbose] [target_node_name] itadm delete-target itadm create-tpg List information about the configured targets. If target_node_name is specified, list only the information for that target. Option is as follows. -v,--verbose Verbose mode. itadm delete-target [-f,--force] target_node_name Delete the target specified by target_node_name. The target must be offline before it can be deleted. Option is as follows. -f,--force If the target persists in an online state, this option attempts to offline the target before deleting it. itadm create-tpg tpg_name IP-address[:port]... Create an iscsi target portal group made up of the specified portals and assign it the identifier tpg_name. Each portal is an IP address and port pair. IPv4 portals are specified in dotted address notation, for example, IPv6 portal addresses must be enclosed in square brackets. This subcommand has no options. itadm list-tpg itadm delete-tpg itadm create-initiator itadm list-tpg [-v,--verbose] [tpg_name] List information about the configured target portal group. If tpg_name is specified then list only the information about the target portal group associated with that tpg_name. Option is as follows. -v,--verbose Verbose mode. itadm delete-tpg [-f,--force] tpg_name Delete the target portal group associated with tpg_name. Option is as follows. -f,--force If the TPG is associated with any targets, the request to delete will be denied unless this option is specified. itadm create-initiator [-s,--chap-secret] [-S,--chap-secret-file path] [-u,--chap-user chap-user-name] initiator_node_name Configure parameters associated with the remote initiator named initiator_node_name. Options are as follows. System Administration Commands - Part

18 itadm(1m) itadm modify-initiator itadm delete-initiator itadm list-initiator itadm modify-defaults -s,--chap-secret As described under the create-target subcommand, above. -S,--chap-secret-file path As described under the create-target subcommand, above. -u,--chap-user chap-user-name Specifies the CHAP username for an initiator, for use in CHAP authentication. If no value is specified then the initiator node name is used as the username. itadm modify-initiator [-s,--chap-secret] [-S,--chap-secret-file path] [-u,--chap-user chap-user-name] initiator_node_name Modify parameters associated with the remote initiator named initiator_node_name. Options are as follows. -s,--chap-secret As described under the create-target subcommand, above. -S,--chap-secret-file path As described under the create-target subcommand, above. -u,--chap-user chap-user-name Specifies the CHAP username for an initiator, for use in CHAP authentication. If no value is specified then the initiator node name is used as the username. itadm delete-initiator initiator_node_name Delete parameters associated with the remote initiator named initiator_node_name. This subcommand has no options. itadm list-initiator [-v,--verbose] initiator_node_name List parameters associated with the initiator named initiator_node_name. Option is as follows. -v,--verbose Verbose mode. itadm modify-defaults [-a,--auth-method radius chap none] [-r,--radius-server IP-address[:port]] [-d,--radius-secret] [-D,--radius-secret-file path][-i,--isns enable disable] [-I,--isns-server IP-address[:port][,IP-address[:port]]] Modify default parameters. Options are as follows. -a,--auth-method radius chap none Specifies the default authentication method to use for all targets. Valid values are radius, chap, and none. chap indicates that initiators connecting to this target must be authenticated using Challenge Handshake Authentication Protocol (CHAP). radius indicates initiators should also be authenticated by means of CHAP, but the required authentication parameters should be obtained from a central RADIUS server. (See 1154 man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

19 itadm(1m) --radius-server and --radius-secret options.) none means that no authentication is required to connect to the target. Individual targets can override this global setting using the -a option of the create-target and modify-target subcommands. -d,--radius-secret RADIUS Shared Secret for centralized CHAP authentication. -D,--radius-secret-file path Path to a temporary file containing the CHAP secret as described in the -d option. -i,--sns enable disable Specifies whether targets should be registered with the set of defined iscsi Name Service (isns) servers. -I,--isns-server IP-address[:port][,IP-address[:port],...] Defines a list of isns servers with which iscsi target nodes will be registered when the isns option associated with the respective target is set. Up to eight isns servers can be specified. To remove all isns servers, use -I none. -r,--radius-server IP-address[:port] Specify the IP address of the RADIUS server used for centralized CHAP authentication. itadm list-defaults Examples itadm list-defaults List information about the default properties. This subcommand has no options. EXAMPLE 1 Creating a Target The following command creates a target. # itadm create-target Target iqn com.sun:02:72e1b181-7bce-c0e6-851e-ec0d8cf14b7a successfully created EXAMPLE 2 Creating a Target with a Specific Name The following command creates a target with a specific IQN. # itadm create-target -n eui.20387ab8943ef7548 or: # itadm create-target \ -n iqn com.sun:02:a9a366f8-cc2b-f c7f29e EXAMPLE 3 Changing a Name The following command changes an IQN for an existing target. # itadm modify-target -n eui.20387ab8943ef7548 \ iqn com.sun:02:a9a366f8-909b-cc2b-f c7f29e System Administration Commands - Part

20 itadm(1m) EXAMPLE 4 Setting up CHAP Authentication The following command sets up CHAP authentication for a target using the default CHAP username. # itadm modify-initiator -s iqn com.sun:01:e d55444 Enter CHAP secret: ********* Re-enter secret: ********* # itadm modify-target -a chap eui.20387ab8943ef7548 EXAMPLE 5 Creating Target Portal Groups The following command creates two target portal groups, A and B, using port 8000 for the addresses in TPG 2. # itadm create-tpg A # itadm create-tpg B : :8000 EXAMPLE 6 Configuring a Target to Use TPGs The following command configures a target to use TPGs A and B. # itadm modify-target -t A,B eui.20387ab8943ef7548 EXAMPLE 7 Setting up RADIUS Authentication for Specific Target The following command sets up RADIUS authentication for a specific target. # itadm modify-defaults -r d Enter RADIUS secret: ********* Re-enter secret: ********* # itadm modify-target -a radius eui.20387ab8943ef7548 EXAMPLE 8 Setting up RADIUS Authentication for All Targets The following command sets up RADIUS authentication for all targets. # itadm modify-defaults -d -r a radius Enter RADIUS secret: ********* Re-enter secret: ********* The preceding command assumes all targets were created with -a default. EXAMPLE 9 Listing Default Properties The following command lists default properties. # itadm list-defaults iscsi Target Default Properties: alias: none 1156 man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

21 itadm(1m) EXAMPLE 9 Listing Default Properties (Continued) auth: none radiusserver: none radiussecret: unset isns: disabled isnsserver: , EXAMPLE 10 Listing Targets The following command lists targets. # itadm list-target TARGET NAME STATE SESSIONS iqn com.sun:02:72e1b181-7bce-c0e6-851e-ec0d8cf14b7a online 0 iqn com.sun:02:2cb0c526-c05a-e279-e396-a367006f4227 online 0 iqn com.sun:02:d14125bb-1c9d-c28d-97b0-f89259b642f3 online 0 iqn com.sun:02:03ff9fc5-794a-e9b4-a081-bb82917c292a online 0 EXAMPLE 11 Listing Targets (Verbose) The following command lists targets with the verbose option. # itadm list-target -v TARGET NAME STATE SESSIONS iqn com.sun:02:d23e68d8-2d79-c988-98e7-a d33c online 0 alias: - auth: none (defaults) targetchapuser: - targetchapsecret: unset tpg-tags: default iqn com.sun:02:94ec46d4-c8e ef03-ffc1dcd66606 online 1 alias: - auth: chap targetchapuser: - targetchapsecret: unset tpg-tags: nge1_ipv4 = 3 EXAMPLE 12 Listing a Specific Target The following command lists targets with the verbose option. # itadm list-target -v \ iqn com.sun:02:2cb0c526-c05a-e279-e396-a367006f4227 TARGET NAME STATE SESSIONS iqn com.sun:02:2cb0c526-c05a-e279-e396-a367006f4227 online 1 alias: - auth: chap targetchapuser: - targetchapsecret: unset tpg-tags: nge1_ipv4 = 3 System Administration Commands - Part

22 itadm(1m) Attributes See attributes(5) for descriptions of the following attributes: ATTRIBUTETYPE ATTRIBUTEVALUE Availability Interface Stability system/storage/iscsi/iscsi-target Committed See Also iscsiadm(1m), stmfadm(1m), libstmf(3lib), attributes(5) 1158 man pages section 1M: System Administration Commands Last Revised 16 Aug 2011

23 stmfadm(1m) Name Synopsis Description stmfadm SCSI target mode framework command line interface stmfadm add-hg-member -g, --group-name group-name group-member... stmfadm add-tg-member -g, --group-name group-name group-member... stmfadm add-view [-n, --lun logical-unit-number -t, --target-group group-name -h, --host-group group-name] lu-name stmfadm create-hg group-name stmfadm create-lu [-p, --lu-prop logical-unit-property=val -s, --size size] lu-file stmfadm create-tg group-name stmfadm delete-hg group-name stmfadm delete-lu lu-name stmfadm delete-tg group-name stmfadm import-lu lu-file stmfadm list-hg [-v] [host-group-name...] stmfadm list-tg [-v] [target-group-name...] stmfadm list-lu [-v] [lu-name...] stmfadm list-target [-v] [target-name...] stmfadm list-view -l, --lu-name lu-name [entry-name...] stmfadm list-state stmfadm modify-lu [-p, --lu-prop logical-unit-property=val -s, --size size, -f, --file] lu-name lu-file stmfadm online-lu lu-name stmfadm offline-lu lu-name stmfadm online-lu target-name stmfadm offline-lu target-name stmfadm remove-hg-member -g, --group-name group-name group-member... stmfadm remove-tg-member -g, --group-name group-name group-member... stmfadm remove-view -l, --lu-name lu-name entry-name The stmfadm command configures logical units within the SCSI Target Mode Framework (STMF) framework. The framework and this man page use the following terminology: initiator A device responsible for issuing SCSI I/O commands to a SCSI target and logical unit. System Administration Commands - Part

24 stmfadm(1m) target A device responsible for receiving SCSI I/O commands for a logical unit. logical unit A device within a target responsible for executing SCSI I/O commands. logical unit number The identifier of a logical unit within a target. initiator group An initiator group is a set of one or more initiators that are combined for the purposes of being applied to a view (see below). An initiator cannot be a member of more than one initiator group. target group A target group is a set of one or more SCSI target ports that are treated the same when creating a view (see below). The set of logical units that a particular SCSI initiator can see is determined by the combined set of views. Each logical unit has a set of view entries, and each view entry specifies a target group, host group, and a LUN. An initiator from that host group, when connecting through that target group, is able to identify and connect to that logical unit using the specified LUN. You can use views to restrict the set of logical units that a specific initiator can see, and assign the set of LUNs that will be used. view A view defines the association of an initiator group, a target group, and a logical unit number with a specified logical unit. Any view entry added to a logical unit must not be in conflict with existing view entries for that logical unit. A view entry is considered to be in conflict when an attempt is made to duplicate the association of any given initiator, target and logical unit number. As an example, logical unit LU_0 has the following view entry associated with it: Logical Unit: LU_0 View Entry: 0 initiator group: HostA target group: All targets logical unit number: 32 If you attempted the following: # stmf add-view -n 31 -h HostA LU_0...the operation would return an error with a message indicating that the view entry is in conflict with one or more existing view entries. This conflict arises because the existing view entry, 0, already has mapped LU_0 to logical unit number 32 for the initiator group HostA man pages section 1M: System Administration Commands Last Revised 22 Aug 2011

25 stmfadm(1m) Sub-commands The stmfadm command supports the subcommands listed below. add-view [-n, --lun logical-unit-number -t, --target-group group-name -h, --host-group group-name] lu-name Adds a logical unit view entry to a logical unit lu-name, where lu-name is the STMF name for the logical unit as displayed by the list-lu subcommand. The add-view subcommand provides the user with a mechanism to implement access control for a logical unit and also provides a means of assigning a logical unit number to a logical unit for a given set of initiators and targets. A logical unit will not be available to any initiators until at least one view is applied. Each view entry gets assigned an entry name, which can be used to reference the entry in the remove-view and list-view subcommands. add-view supports the following options: -n, --lun logical-unit-number logical-unit-number is an integer in the range to be assigned to the logical unit for this view entry. If this option is not specified, a logical unit number will be assigned by the STMF framework. -t, --target-group group-name group-name is the name of a target group previously created using the STMF create-tg subcommand. If this option is not specified, the logical unit will be available through all targets. -h, -host-group group-name group-name is the name of an host group previously created using the STMF create-hg subcommand. If this option is not specified, the logical unit will be available to all initiators that log in to the STMF framework. add-hg-member -g group-name group member... Add a host group member to a host group. group-name must be an existing group created using the create-hg subcommand. group member can be specified as name_type.name_value, where name_type can be one of the following: wwn iqn eui...and name_value is the value of the initiator name. As an example, to add a fibre channel initiator port world-wide name e08b to the host group HostA, the command would be: # stmfadm add-hg-member -g HostA wwn e08b To add an ISCSI initiator node member with the name iqn com.sun:01.46f7e262 to HostA, the command would be: # stmfadm add-hg-member -g HostA iqn com.sun:01.46f7e262 Alternatively, members can be specified using their SCSI name string identifiers. To add the two initiators above using their SCSI name string identifiers, the commands would be: System Administration Commands - Part

26 stmfadm(1m) # stmfadm add-hg-member -g HostA eui e08b # stmfadm add-hg-member -g HostA iqn com.sun:01.46f7e262 A host group member cannot be a member of more than one host group. add-tg-member -g group-name group member... Add a target group member to a target group. group-name must be an existing group created using the create-tg subcommand. group member can be specified as name_type.name_value, where name_type can be one of the following: wwn iqn eui...and name_value is the value of the target name. As an example, to add a fibre channel target port world-wide name e092376af7 to the target group TG0, the command would be: # stmfadm add-tg-member -g TG0 wwn e092376af7 To add an ISCSI target member with the name iqn com.sun:target to TG0, the command would be: # stmfadm add-tg-member -g TG0 iqn com.sun:target Alternatively, members can be specified using their SCSI name string identifiers. To add the two targets above using their SCSI name string identifiers, the commands would be: # stmfadm add-tg-member -g TG0 eui e092376af7 # stmfadm add-tg-member -g TG0 iqn com.sun:target A target group member cannot be a member of more than one target group. create-hg group-name Create an initiator group with the name group-name. group-name is a string of Unicode characters with a maximum length of 255. The group name must be unique within the STMF system. create-lu [-p, --lu-prop logical-unit-property=val --s, --size size] lu-file Create a logical unit that can be registered with STMF. For the -p option, logical-unit-property can be one of the following properties: alias Up to 255 characters, representing a user-defined name for the device. The default is the name of the backing store. blk Specifies the block size for the device. The default is 512, but do not set this value higher than 4096 KB. guid Thirty two hexadecimal ASCII characters representing a valid NAA Registered Extended Identifier. The default is set by the STMF to a generated value man pages section 1M: System Administration Commands Last Revised 22 Aug 2011

27 stmfadm(1m) host-id Eight hexadecimal ASCII characters representing the host ID assignment. This will be used to generate the globally unique identifier (GUID) for the logical unit. The default is the value returned by hostid(1). meta Metadata file name. When specified, will be used to hold the SCSI metadata for the logical unit. There is no default. mgmt-url Up to 1024 characters representing a Management Network Address URL. More than one URL can be passed as a single parameter by using space-delimited URLs enclosed inside a single pair of quotation marks ("). oui Organizational Unique Identifier. Six hexadecimal ASCII characters representing the IEEE OUI company ID assignment. This will be used to generate the device identifier (GUID). The default is 00144F. pid Sixteen characters of product identification SCSI SPC-3. This value will be reflected in the Standard INQUIRY data returned for the device. The default is COMSTAR. serial Serial Number. Specifies the SCSI Vital Product Data Serial Number (page 80h). It is a character value up to 252 bytes in length. There is no default value. vid Eight characters of vendor identification per SCSI SPC-3. This value will be reflected in the Standard INQUIRY data returned for the device. The default is SUN. wcd Write-back cache disable. Specify true or falseto determine write-back cache disable behavior. The default is the write-back cache setting of the backing store device specified by the lu-file argument. wp Write-protect bit. Specify true or false to determine whether the device reports as write-protected. The default is false. For the -s option, size is an integer followed by one of the following letters, to indicate a unit of size: k kilobyte m megabyte g gigabyte t terabyte System Administration Commands - Part