EMC CLARiiON iscsi Server Setup Guide for HP-UX

Transcription

1 EMC CLARiiON iscsi Server Setup Guide for HP-UX P/N Revision A03 May 30, 2008 This document describes how to configure iscsi initiator ports and how to set up iscsi security on a server connected to the iscsi data ports on CX4 UltraFlex TM series, CX3 UltraScale TM series, CX series, and AX4 5 series storage systems. We recommend that you use this guide in conjunction with one of the followingguides,whichareavailableonthepowerlink website: thestorage-systemsetupguide(ax4 5serieswithNavisphereExpress, CX4 series, CX3 series, or CX series storage systems) the installation roadmap (P/N ) (AX4 5 series with Navisphere Manager, CX4 series, CX3 series, or CX series storage systems) IMPORTANT Only network interface cards (NICs) are currently supported. For more information on supported operating system revisions, driver types, or features, refer to the E-Lab Interoperability Navigator on the Powerlink website for CX4 series, CX3 series, or CX series storage systems, and the Support Matrix link on the Install page of the storage-system support website for AX4-5 series or AX series storage systems. Topics include: Before you start... 2 iscsi server setup process overview... 5 Installing NIC or HBA iscsi initiator software... 6 Assigning an IP address to a NIC or iscsi HBA... 7 Configuring access to the iscsi target devices... 8 Registering the iqn number with the storage system Preparing for CHAP security Configuring CHAP on the iscsi initiators

2 Before you start Before you use this guide to set up iscsi initiator ports on the server or to set up iscsi security (Challenge Handshake Authentication Protocol CHAP),youmust: configure the storage-system iscsi ports as described in the storage-system setup guide or the installation roadmap (storage systems with Navisphere Manager only). complete the worksheets in the storage system configuration planning guide that either shipped with your storage system or that you generated from the customized storage-system support website. For AX4-5 series, you can generate a planning guide using the Plan link on the Install page of the storage-system support website. For CX4 series, CX3 series or CX series, you can generate a planning guide using the Plan link on the storage-system support website. You should also verify that the following is true: All network hardware has been installed, including any NICs, switches, and cabling. Refer to the appropriate documentation for any components that you are installing, including switch documentation, and the configuration worksheet that you created when you installed your storage system. The storage-system iscsi ports have been configured. The latest HP-UX patches have been installed on the server. For informationonthelatestpatches,refertowww.hp.com. For more informationonchapsecurity,refertothechap security overview, page 3. Otherwise, refer to the iscsi server setup process overview, page 5. Terms used in this guide The table below lists the storage system terms used in this guide. 2 EMC CLARiiON iscsi Server Setup Guide for HP-UX

3 Table 1 Storage system models Storage system term Refers to CX4 series CX4-120, CX4-240, CX4-480, and CX4-960 storage systems CX3 series CX3 model 10 systems, CX3 model 20 systems, CX3 model 40 systems, and CX3 model 80 storage systems CX series AX4-5 series CX200, CX300 series, CX400, CX500 series, CX600, and CX700 storage systems AX4-5SC, AX4-5SCi, AX4-5, AX4-5i storage systems CHAP security overview Challenge Handshake Authentication Protocol (CHAP) is a method of authenticating iscsi users. The iscsi storage system can use CHAP to authenticate initiators and initiators can likewise authenticate targets such as the storage system.! CAUTION If you do not configure CHAP security for the storage system, any host connected to the same IP network as the storage-system iscsi portscanreadfromandwritetothestoragesystem. Ifthestorage system is on a private network, you can choose not to use CHAP security. If the storage system is on a public network, we strongly recommend that you use CHAP security. If you want to use CHAP security, you must set up and enable it on both the server and storage system before preparing LUNs or virtual disks to receive data. If you prepare disks to receive data before you set up and enable CHAP security, you lose access to the LUNs or virtual disks. While you are setting up and enabling CHAP, you may temporarily loose connectivity between the server and the storage system. CHAP has the following two variants: Initiator CHAP - Sets up accounts that iscsi initiators use to connect to targets. The target authenticates the initiator. Initiator CHAP is the primary CHAP authentication method. EMC CLARiiON iscsi Server Setup Guide for HP-UX 3

4 Navisphere Express provides Basic and Advanced initiator CHAP options. Basic CHAP specifies one secret (password) for all initiators thatlogintoagiventarget. TheAdvanced option allows you to specify a different secret for each initiator, and also allows you to set up mutual CHAP. Mutual CHAP - Applied in addition to initiator CHAP, mutual CHAP sets up an account that a target uses to connect to an initiator. The initiator authenticates the target. The HP-UX documentation uses the term uni-directional CHAP to describe initiator CHAP and bi-directional CHAP to describe mutual CHAP. 4 EMC CLARiiON iscsi Server Setup Guide for HP-UX

5 iscsi server setup process overview The following overview describes the steps required for configuring iscsi initiator ports and setting up iscsi security. Configuring iscsi initiator ports Install the network interface card (NIC) or host bus adapter (HBA) iscsi initiator software on each server with NICs or iscsi HBAs that you will connect to the storage system as described in Installing NIC or HBA iscsi initiator software,page 6. Assign an IP address for the NICs or iscsi HBAs as described in Assigning an IP address to a NIC or iscsi HBA, page 7. Configure access to the iscsi target devices as described in Configuring access to the iscsi target devices, page 8. Setting up iscsi security Prepare for setting up CHAP on the server as described in Preparing for CHAP security, page13. Configure initiator and mutual (optional) CHAP on each NIC or iscsi HBA initiator as described in Configuring CHAP on the iscsi initiators, page14. EMC CLARiiON iscsi Server Setup Guide for HP-UX 5

6 Installing NIC or HBA iscsi initiator software You must install NIC or HBA iscsi initiator software on each server with NICs or iscsi HBAs that you will connect to the storage system. Only NICs are currently supported. Downloading and installing the HP-UX iscsi initiator software 1. Open a web browser and connect to the HP-UX website: 2. Select iscsi software initiator. 3. From the HP-UX iscsi Software Initiator page, select HP-UX iscsi software initiator. The Product details and specifications page opens. 4. Download the documentation listed under the Documentation heading. You may need to refer to these documents when you download and install the initiator software. 5. Select Receive for Free and follow the instructions on the site to download the initiator software. 6. Install the initiator software. 6 EMC CLARiiON iscsi Server Setup Guide for HP-UX

7 Assigning an IP address to a NIC or iscsi HBA Assign an IP address to each NIC or iscsi HBA in the server that will be connected to the storagesystem. For the NIC or iscsi HBA IP addresses, refer to the iscsi target and initiator port network information worksheet, which you should have completed when you planned your configuration using the Administration Worksheet and the configuration and planning guide. Only NICs are currently supported. Assigning an IP address to a NIC in an HP-UX server 1. At the HP-UX server, log in as superuser (root). 2. Atthecommandprompt(#)inthehpterm or xterm window, open the sam utility by entering sam. 3. Select Networking and Communications. 4. Select Network Interface Cards. 5. Select the Ethernet card you want to configure. 6. From the main menu, select Actions > Configure. 7. Enter the IP address and select OK. EMC CLARiiON iscsi Server Setup Guide for HP-UX 7

8 Configuring access to the iscsi target devices Before an iscsi initiator can send data to or receive data from the storage system, you must configure the network parameters for the NIC initiators so that they can connect to the storage-system storage processor (SP) iscsi targets. To configure access to the iscsi target devices: 1. Verify that you are logged in as superuser (root). 2. Add the path for the iscsiutil and other iscsi executables to the root path as follows: #PATH=$PATH:/opt/iscsi/bin 3. Verify the iscsi initiator name by executing the iscsiutil -l command. The iscsi software initiator configures a default initiator name in an iscsi Qualified Name (iqn) format, for example, iqn com.hp:hpfcs If you would like to change the default iscsi initiator name or reconfigure the name to an IEEE EUI-64 (eui) format, continue to the next step; otherwise, skip to step Configure the default iscsi initiator name. # iscsiutil [iscsi-device-file] -i-niscsi-initiator-name For more information on iqn and eui formats, refer to the HP-UX iscsi software initiator guide. where: iscsi-device-file is the iscsi device path, /dev/iscsi, and is optional if you include the -i or -N switches in the command. -i configures iscsi initiator information. 8 EMC CLARiiON iscsi Server Setup Guide for HP-UX

9 -N is the initiator name. When preceded by the -i switch, it requires the iscsi initiator name. The first 256 characters of the name string arestoredintheiscsipersistentinformation. iscsi-initiator-name is the initiator name you have chosen, in iqn or eui format. 5. Verify the new iscsi initiator name. iscsiutil -l 6. For each iscsi target device you will statically identify, store thetargetdeviceinformationinthekernelregistry. Addone(or several) discovery target(s). # iscsiutil [/dev/iscsi] -a -I ip-address hostname [-P tcp-port] [-M portal-grp-tag] where: -a adds a discovery target address into iscsi persistent information. You can add discovery target addresses only with this option. -I is the option that requires the IP address or the hostname of the discovery target portal address. ip-address hostname is the IP address or hostname component of the target network portal. -P tcp-port is the listening TCP port component of the discovery target network portal (optional). The default iscsi TCP port number is M portal-grp-tag is the target portal group tag (optional). The default target portal group tag for discovery targets is 1. For example, iscsiutil -a -I or, if you specify the hostname, iscsiutil -a -I target.hp.com. EMC CLARiiON iscsi Server Setup Guide for HP-UX 9

10 If an iscsi TCP port used by the discovery target is different than the default iscsi port of 3260, you must specify the default TCP port used by the discovery target; for example, iscsiutil -a -I P 5001 or iscsiutil -a -I target.hp.com -P Verify the discovery target(s) that you have configured. iscsiutil -p -D 8. To discover the operational target devices, enter /usr/sbin/ioscan -H To create the device files for the targets, enter /usr/sbin/insf -H To display operational targets, enter # iscsiutil -p -O. 10 EMC CLARiiON iscsi Server Setup Guide for HP-UX

11 Registering the iqn number with the storage system This section describes how to register the iqn number with the storage system using the Navisphere Server Utility or the Navisphere Host Agent (storage systems with Navisphere Manager only). Registering the iqn number using the Navisphere Host Agent (storage systems with Navisphere Manager only) If you have the host agent installed, use it to register the iqn number. 1. Start the Navisphere Host Agent. /sbin/init.d/agent start 2. Reboot the server. Registering the iqn number using the Navisphere Server Utility If you have the server utility installed, use it to register the iqn number. Starting the Navisphere Server Utility on an HP-UX server 1. Open an hpterm window. 2. Navigate to the Navisphere bin directory and run the server utility: /opt/navisphere/bin/naviserverutil Registering the server using the Navisphere Server Utility for HP-UX If the host agent is running, stop the host agent service. 1. In the server utility, enter 1 to select Update Server Information. The utility automatically scans for connected storage systems, and displays a list of the ones it finds. 2. In the server utility, enter u toregistertheserverwitheachstorage system the utility found. EMC CLARiiON iscsi Server Setup Guide for HP-UX 11

12 The utility sends the server s name and IP address to each storage system. Once the server has storage on the storage system, the utility also sends the HP-UX device name and volume or file system information for each virtual disk or LUN in the storage system that the server sees. 3. Enter c (cancel) to stop the utility. 4. If you stopped the host agent, restart it. 5. Reboot the server. 12 EMC CLARiiON iscsi Server Setup Guide for HP-UX

13 Preparing for CHAP security To prepare for using CHAP security, you must have done the following: Completed the CHAP worksheets in the chapter on iscsi configuration in the appropriate configuration and planning guide that either shipped with your storage system or that you generated from the customized storage-system support website. EMC CLARiiON iscsi Server Setup Guide for HP-UX 13

14 Configuring CHAP on the iscsi initiators Before configuring CHAP security on iscsi initiators, verify that you have completed the steps listed in the previous section, Preparing for CHAP security. The HP-UX documentation uses the term uni-directional CHAP to describe initiator CHAP and bi-directional CHAP to describe mutual CHAP. Navisphere Express refers to initiator CHAP as basic CHAP. Configuring initiator CHAP on NIC initiators in a HP UX server! CAUTION You must enable CHAP security for the NIC or before you can configure CHAP on the storage system. While you are setting up and enabling CHAP, you may temporarily loose connectivity between theserverandthestoragesystem. To configure initiator CHAP: 1. Verify that you are logged in as superuser (root). 2. Configure one of the following initiator CHAP authentication methods: Global # iscsiutil -u -H CHAP_UNI Discovery target address # iscsiutil -u -H CHAP_UNI -I M 3 Operational target # iscsiutil -u -H CHAP_UNI -T iqn com.hp.stor:iscsi Operational target address # iscsiutil -u -H CHAP_UNI -T iqn com.hp.stor:iscsi -I P M 1 3. Configure the CHAP initiator username. 14 EMC CLARiiON iscsi Server Setup Guide for HP-UX

15 # iscsiutil -u -N chap-initiator-name [-T target-name] [-I ip-address] [-P tcp-port] [-M portal-grp-tag] If you did not configure the CHAP initiator name, the utility will use the iscsi initiator name. For example: Global # iscsiutil -u -N mychapusername Discovery target address # iscsiutil -u -N mychapusername -I M 2 Operational target # iscsiutil -u -N mychapusername -T iqn com.hp.stor:iscsi Operational target address # iscsiutil -u -N mychapusername -T iqn com.hp.stor:iscsi -I P M 1 4. Configure the initiator CHAP secret. # iscsiutil -u -W chap-initiator-secret [-T target-name] [-I ip-address] [-P tcp-port] [-M portal-grp-tag] You can enter the secret in two forms ASCII and hexadecimal. In the hexadecimal form, the number of hex digits must be even. For example: Global # iscsiutil -u -W mychapsecret or # iscsiutil -u -W 0xed345ba678dfffe54e35666fa2c3c3 Discovery target address # iscsiutil -u -W mychapsecret -I M 1 Operational target # iscsiutil -u -W mychapsecret -T iqn com.hp.stor:iscsi Operational target address # iscsiutil -u -W mychapsecret -T iqn com.hp.stor:iscsi -I P M 1 5. Enter one of the following commands to verify the initiator CHAP parameters you configured: EMC CLARiiON iscsi Server Setup Guide for HP-UX 15

16 All global targets # iscsiutil -l All discovery targets # iscsiutil -pd All operational targets # iscsiutil -po A particular operational target # iscsiutil -p -T target-name 6. When the output is displayed, verify the authentication method, CHAP method, initiator CHAP name, and CHAP secret. Configuring mutual (target) CHAP on NIC initiators on an HP-UX server! CAUTION You must enable CHAP security for the NIC or before you can configure CHAP on the storage system. While you are setting up and enabling CHAP, you may temporarily loose connectivity between theserverandthestoragesystem. Setting up mutual CHAP requires a RADIUS server. For more information on a RADIUS server, refer to the HP-UX documentation. 1. Verify that you are logged in as superuser (root). 2. Follow the same procedures to configure the mutual CHAP usernameandsecretasyoudidforinitiatorchap. 3. Configure the Network Access Server (NAS) and RADIUS server parameters. # iscsiutil -u -R nas-hostname nas-secret radius-server-hostname where: -u configures initiator and target CHAP authentication parameters. -R allows you to specify the nas-hostname, nas-secret, radius-server-hostname arguments. Nas-hostname is the IP address or hostname of the NAS. NAS operates as a client of a RADIUS server, 16 EMC CLARiiON iscsi Server Setup Guide for HP-UX

17 which is the host that runs the iradd daemon. Nas-secret is the secret for the iradd daemon. You must configure this secret as the NAS secret of iradd on the RADIUS server. This secret is used by iradd to authenticate the RADIUS server. Radius-server-hostname is the IP address or hostname of the RADIUS server. For more information on NAS and RADIUS servers, refer to the appropriate HP-UX software initiator documentation. 4. Add a RADIUS client through the Access Devices menu on the RADIUSserver.Besuretoenterthenas-hostname in the Name field and the nas-secret in the Shared Secret field. 5. Add a user to the RADIUS server with the target CHAP username and secret. 6. Configure mutual CHAP. # iscsiutil -u -H chap-authentication-type [-T target-name] [-I ip-address>] [-P tcp-port] [-M portal-grp-tag] Example authentication methods for configuring mutual CHAP: Global # iscsiutil -u -H CHAP_BI Discovery target address # iscsiutil -u -H CHAP_BI -I M 3 Operational target # iscsiutil -u -H CHAP_BI -T iqn com.hp.stor:iscsi Operational target address # iscsiutil -u -H CHAP_BI -T iqn com.hp.stor:iscsi -I P M 1 7. Enter one of the following commands to verify the mutual CHAP parameters you configured: All global targets # iscsiutil -l All discovery targets # iscsiutil -pd All operational targets # iscsiutil -po A particular operational target # iscsiutil -p -T target-name 8. When the output is displayed, verify the authentication method, CHAP method, initiator CHAP name, CHAP secret, NAS hostname, NASsecret,andRADIUSserverhostname. EMC CLARiiON iscsi Server Setup Guide for HP-UX 17

18 9. Start the iradd (iscsi CHAP) daemon. #iradd Once the iradd daemon starts, it will automatically start every time the system reboots. 18 EMC CLARiiON iscsi Server Setup Guide for HP-UX

19 Copyright 2008 EMC Corporation. All Rights Reserved. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. All other trademarks mentioned herein are the property of their respective owners. EMC CLARiiON iscsi Server Setup Guide for HP-UX 19