3.1. Storage. Direct Attached Storage (DAS)

Transcription

1 3.1. Storage Data storage and access is a primary function of a network and selection of the right storage strategy is critical. The following table describes the options for server and network storage. Method Description Direct Attached Storage (DAS) uses storage devices that are connected directly to the server, either internally or contained within an external storage cabinet. Hard disk drives (typically SCSI or possibly SATA disks) are connected to the server through a host bus adapter (HBA). Direct Attached Storage (DAS) DAS provides a low cost, high performance storage solution. Data is saved to the storage device using block level writes. This is faster than writing data as a file. Storage devices are typically controlled by a single server, so that all access to the storage must go through the server. If the server fails, access to the storage devices is lost. Multiple servers can share the storage device, but multiple server access is typically limited to a clustered configuration to provide access to the data when one server is unavailable. Network Attached Storage (NAS) With Network Attached Storage (NAS), external storage devices are connected to the network, sharing the network with servers, workstations, and other devices. Client devices access the NAS device to read and write files in the same way that clients access files on a file server. A NAS device is typically a pared down file server consisting of: A storage enclosure with terabytes of storage space. A motherboard (logic board).

2 One or more network interface cards. Multiple interface cards allow you to perform adapter teaming. A minimal network operating system. NAS devices use file transfer, such as Server Message Block (SMB) for Windows clients, to read and write files from the NAS device. File transfer operations are slower than block level operations. A Storage Area Network (SAN) connects multiple servers with multiple external storage devices through a dedicated network. With a SAN: Storage Area Network (SAN) Storage devices and servers are connected to the private storage area network. Client computers are not connected to the SAN, but communicate with the servers to access files from the storage devices. All of the devices that connect servers and storage together are called the SAN fabric. Each server is configured with the storage units on the storage devices that it can access. You can configure multiple servers for each storage unit, or multiple storage units for each server. Servers are connected to the SAN through an HBA. For redundancy, you can use multiple HBAs to connect the server to the SAN. On servers, define virtual partitions or virtual disks called Logical Unit Numbers (LUNs). LUNs appear to servers as local disks. Special networking protocols allow servers to send blocklevel read and write operations to the storage devices. Performance is similar to data access from direct attached storage, but with greater distances and shared storage. When implementing a SAN with Windows Server, devices must support the Virtual Disk Specification (VDS).

3 3.2. Disk Directly attached storage is commonly implemented in the following ways: Internal hard disks using an internal bus and IDE, SCSI, or SATA drives. External USB, esata, or Firewire disks. Rack mounted storage connected to the server through an external connector or external bus. When you add a new disk to a Windows Server system, you will be prompted to initialize the disk and select a partition style. The partition style identifies how information about disk partitions is stored. The following table identifies the two partition styles of disks. Partition Style Master Boot Record (MBR) GUID Partition Table (GPT) Description MBR is the traditional partitioning method. With MBR, you can have: Up to 4 partitions A maximum of 2 TB per partition With MBR, partitioning information is often stored in hidden locations on the disk or even within the operating system. These locations might vary from vendor to vendor. GPT is a newer partitioning method. With GPT, you can have: Up to 128 partitions (Windows restriction) Disks over 2 TB in size GPT disks are only supported on the following Windows operating systems: Windows XP x64, Windows Server 2003 SP1 or higher, Windows Server 2008/2012/2016, and Windows Vista/7/8/10 can use GPT disks for data but not for the disk

4 that holds the boot partition. 32 bit versions of Windows XP do not support GPT. With GPT, partition information is stored on the disk in welldocumented locations. Each partition is identified by a GUID number. GPT also provides redundancy for the partition table. You define storage areas on a disk by creating volumes. The way that volumes are handled depends on the disk type, either basic or dynamic. Disk Type Description A basic disk only supports volumes made up of contiguous disk space. Other limitations depend on the partition style used: Basic On an MBR disk, a basic disk has a limit of four partitions. o You can have up to four primary partitions or up to three primary partitions and one extended partition. o The extended partition can be divided into multiple logical drives. On a GPT disk, you can have an unlimited number of partitions, although Windows imposes a limit of 128 partitions. GPT disks do not have an extended partition. On basic disks, you can shrink or extend volumes only on the same disk. A dynamic disk supports volumes from contiguous and non contiguous disk space. Dynamic Dynamic disks support up to 128 volumes on both MBR and GPT disks. Use dynamic volumes to extend existing volumes onto the same disk using non contiguous space, to extend a volume onto a different disk (creating a spanned volume), or to implement striping or mirroring.

5 Dynamic disks store partitioning information in a hidden database on all dynamic disks in the system. The main reason to choose dynamic over basic disks is to take advantage of advanced disk configurations that involve spanned, striped, and mirrored volumes. You can convert a basic disk to a dynamic disk without destroying data in existing volumes. Sergey Gorokhod MCT/MCSE/MCITP/MCTS/MCSA/CCSE/CCSA/CCNA/A+ E mail: sergey@infosec.co.il Mob: (+972)

6 3.3. Volume A volume identifies an area of storage that the operating system can use for storing data. A volume is either basic or dynamic, based on the type of disk on which the volume resides. Basic volumes exist only on basic disks. Basic volumes correspond to the primary or extended partitions on the disk. You can extend basic volumes on the same disk, using only contiguous free space. Dynamic volumes exist only on dynamic disks. Dynamic volumes can include non contiguous space on the same disk, or space on other dynamic disks. Use dynamic volumes on dynamic disks to take advantage of advanced disk configurations that provide for increased performance or fault tolerance. The following table describes the dynamic volume types: Volume Type Description A simple volume contains a single, contiguous block of space from a single hard disk. Simple You can extend a simple volume onto the same disk, as long as the disk space is contiguous. Simple volumes do not provide any performance or fault tolerance advantages. Spanned A spanned volume combines areas from two or more disks into one storage unit. The primary purpose of a spanned volume is to add more storage space to an existing volume. A spanned volume: Fills the first area, then the second, and so on. Does not provide fault tolerance. If one hard disk fails, you lose all data. Cannot contain system or boot files.

7 Can include space from between 2 and 32 physical disks. The amount of space used on each disk can be different. Has no overhead all disk space is available for storing data. A striped volume breaks data into units and stores the units across a series of disks. This means that when you save a single file, pieces of the file will be found in all disks in the array. Striped volumes: Striped (RAID 0) Use two or more disks. The amount of space used on each disk must be the same. Provide an increase in performance. Multiple disk controllers read and write data at the same time, reducing the overall time to read or write any file. Do not provide fault tolerance. A failure of one disk in the set means all data is lost. Have no overhead all disk space is available for storing data. A striped volume with parity combines disk striping across multiple disks with parity for data redundancy. Parity information is stored on each disk. If a disk fails, its data can be recovered using the parity information stored on the remaining disks. RAID 5 volumes: Striped with parity (RAID 5) Require a minimum of three disks, with equal space being used on each disk. Provide fault tolerance. Data is available even if one disk in the set fails, though performance is significantly impaired. Provide an increase in performance (although the performance is not as good as a striped volume). Have an overhead of one disk in the set for parity information. o A set with 3 disks has 33% overhead.

8 o o A set with 4 disks has 25% overhead. A set with 5 disks has 20% overhead. A mirrored volume stores two copies of each file, with one copy on each disk or disk set. Mirrored volumes: Mirrored (RAID 1) Require two disks. Provide fault tolerance. If one disk fails, data is preserved on the other disk, and the system switches immediately from the failed disk to the functioning disk to maintain availability. Do not increase performance. Have a 50% overhead. Data is written twice, meaning that half of the disk space is used to store the second copy of the data. Disk duplexing is a type of mirroring. Disk duplexing uses two hard drives and two separate disk controllers. Disk duplexing eliminates the single point of failure when a single disk controller is used. If you implement a hardware RAID solution, you can create the following additional solutions: Level Description You can combine mirroring and disk striping into a single volume. RAID RAID RAID combines disk striping and disk mirroring. Multiple disks are striped creating a single volume. A second set of disks is then added to mirror the first set. RAID combines disk mirroring and disk striping. Multiple disks are configured into two mirrored arrays which are then striped. Both RAID and RAID 1 + 0: Provide fault tolerance. Data is available even if one disk in the set fails.

9 Provide an increase in performance. Require an even number of disks, with a minimum of four disks. Have 50% overhead due to mirroring. RAID RAID RAID is a RAID 0 array striped across RAID 5 elements to improve RAID 5 performance without reducing data protection. It combines the straight block level striping of RAID 0 with the distributed parity of RAID 5. RAID volumes: Offer exceptional performance. Require a minimum of 6 disks. Will still work if one drive from each set fails. RAID is also a supported configuration. RAID consists of two RAID 5 arrays that are configured as drive sets. The entire drive sets are then mirrored. RAID volumes allow for failure of multiple drives, but come at a high cost and less performance. RAID is also a supported configuration. Sergey Gorokhod MCT/MCSE/MCITP/MCTS/MCSA/CCSE/CCSA/CCNA/A+ E mail: sergey@infosec.co.il Mob: (+972)

10 3.4. Disk Management Be aware of the following when managing disks and volumes for directly attached storage: Use Disk Management or the Diskpart command to manage disks and volumes. When you first add a new disk to a Windows Server 2008/2012/2016 system, you must initialize the disk before you can create volumes. When you initialize the disk, you define the partition style to be used on the disk. If the system does not find the disk, for example if you have just inserted a new hot swappable disk, rescan for disks in Disk Management. Refreshing the console does not scan for new disks. You can convert a disk using MBR to GPT, but only if the disk does not contain any partitions. Delete any volumes on the disk to convert an existing MBR disk to use GPT. Each disk is either an MBR disk or a GPT disk. You can, however, have both MBR and GPT disks in the same system. You can convert a basic disk to a dynamic disk without losing data in existing partitions. o Existing basic volumes and logical drives in the extended partition are converted to dynamic volumes. o You must reboot the system to complete the conversion if the disk contains the boot or system volume, or if the volume includes the pagefile. o To convert from a dynamic disk to a basic disk, you must delete all existing volumes. To add space to existing volumes, use one of the following strategies: Method Extend the volume Description When you extend a volume, you add unallocated space to the volume. o For basic volumes, you can only extend the volume onto the same drive using contiguous unallocated space.

11 o o To extend the volume onto the same drive using noncontiguous unallocated space, convert the disk to a dynamic disk, then extend the volume. To extend the volume onto another disk, convert the disk to a dynamic disk and extend the volume. Extending the volume onto another disk creates a spanned volume. Volumes must be unformatted or formatted with NTFS to be extended. A mount point is an empty folder on the existing volume that points to another partition. Data saved to the folder is physically saved on the referenced partition. Configure a mount point o o o o Both partitions must be formatted with NTFS. You can create mount points on basic or dynamic volumes. The folder on the source volume must be empty. The target partition must not have a drive letter. You can provide fault tolerance for an existing volume by mirroring the volume. To create a striped or RAID 5 volume, you must create a new volume. You cannot add fault tolerance with RAID 5 or increase performance with RAID 0 for an existing volume. You cannot stripe a spanned volume. You cannot extend a striped volume. You can use both MBR and GPT dynamic disks together. You can extend a volume from a MBR disk onto a GPT disk. Using both MBR and GPT disks in mirrored or striped arrays is not recommended. If you move a dynamic disk from one system to another, use the Import Foreign Disks option. This copies the partition database from the new disk and merges it with the partition table on the existing dynamic disks. You can also use the Diskpart import command. If a disk fails, the actions you take to recover from the failed disk depends on the type of volume.

12 Volume Type Basic, simple, spanned, or striped Recovery Process Basic, simple, spanned, or striped volumes are not fault tolerant. If a disk with one of these volumes fails, all data on the volume is lost. To recover, you must recreate the volume and restore the data from backup. 1. Install a new physical disk. 2. In Disk Management, delete the existing volume. 3. Upgrade the new disk to dynamic, then create a new volume using the old and new disks. 4. Restore the data from a backup. To recover a failed disk in a mirror configuration: Mirrored volume 1. Install the new physical disk. 2. In Disk Management, break the mirror. 3. Upgrade the new disk to dynamic, then recreate the mirror using the new disk. You can also use the Diskpart add disk command to add a mirror to the existing volume. 4. Delete the failed logical disk. You can use the Diskpart delete disk command to remove missing dynamic disks. To recover a failed disk in a RAID5 configuration: RAID 5 1. Install the new physical disk. 2. In Disk Management, upgrade the new disk to dynamic. 3. Repair the volume using the new disk. 4. Delete the failed logical disk. Note: Both mirrored and RAID 5 configurations can continue to operate if a single disk fails. However, the data will not be protected, and all data will be lost if a second disk fails before the first disk is replaced. On RAID 5 volumes with a missing disk, performance will be slow until the disk is replaced because data from the missing disk must be calculated from the parity information on the remaining disks.

13 3.5. iscsi and Fibre Channel The collection of hardware components that creates the storage network is called the SAN fabric. The following methods are typically used to create the SAN fabric: Method Description iscsi is a network protocol that encapsulates SCSI block level commands within IP packets for transmission over an Ethernet network. iscsi Use Ethernet hardware to create the storage network. Hardware includes fiber optic or Cat5/5e cables and Ethernet switches and NICs. Using regular Ethernet hardware lowers the cost of an iscsi implementation. Storage devices are called targets. Servers use a logical entity called an iscsi initiator to communicate with the target. The initiator identifies iscsi adapters that can be used to communicate with targets. Internet Storage Name Service (isns) servers provide discoverability and zoning of SAN resources. Initiators contact isns servers to dynamically locate targets. Because iscsi sends TCP/IP packets, you can add storage devices to your regular network so that the SAN shares the network with other devices. However, performance could suffer because the available bandwidth is shared by many more devices. Fibre Channel (FC) Fibre Channel (FC) is an integrated set of standards that defines how block level SCSI commands are sent over a storage area network. Fibre Channel can use either fiber optic or twisted pair copper cables. Host bus adapters connect servers and storage devices to the network.

14 Special FC switches connect devices and create the network topology. You should be aware of two additional protocols related to FC: Fibre Channel over IP (FCIP) puts FC packets within IP packets. FCIP uses the existing FC fabric, but sends FC packets using IP. Similar to iscsi, the Internet Fibre Channel Protocol (ifcp) wraps FC data in IP packets for sending over an Ethernet network. When choosing between iscsi and FC, be aware of the following: iscsi is cheaper and can be easier to implement than FC. FC requires specialized hardware and knowledge, while iscsi can be implemented using standard Ethernet hardware and TCP/IP. iscsi is currently not as fast as FC. Using Gigabit Ethernet hardware, an iscsi implementation can approximately match the speed of the slowest FC SAN. Fibre Channel has a distance limitation of 10km. With iscsi, you can send IP packets over longer distances if desired. iscsi devices have built in security features that FC devices do not. You can enable Challenge Handshake Authentication Protocol (CHAP) for authentication and IPSec for encryption. FC security is implemented primarily through limiting physical access. Sergey Gorokhod MCT/MCSE/MCITP/MCTS/MCSA/CCSE/CCSA/CCNA/A+ E mail: sergey@infosec.co.il Mob: (+972)

15 3.6. SAN Management Tool Microsoft has built in SAN awareness in Windows Server 2008/2012/2016 and provides a number of tools for working with and managing SANs. The following table identifies these tools and their features. Tool Virtual Disk Service (VDS) Features The Virtual Disk Service (VDS) is an API that enables support for SAN hardware and management in Windows. The API exposes disk systems and SAN hardware to Windows administrative tools. Most Windows storage tools rely on VDS, and SAN hardware should be VDS compatible. For each device you want to manage, install the VDS provider supplied by the manufacturer. Disk Management is system utility for managing hard disks and volumes or partitions. Using Disk Management, you can: Disk Management Initialize disks and create volumes or partitions. Format volumes with FAT32 or NTFS file systems. Perform most tasks without restarting the system. Extend or shrink partitions from the Windows interface. Share and Storage Management includes the Provision Storage Wizard that you can use to create volumes on both local and VDS compliant subsystems. When using the wizard for SAN management: Share and Storage Management You can assign a logical unit number (LUN) on FC and iscsi subsystems. A LUN identifies a storage area on the storage device and can point to an entire disk, a section of a disk, or an array of disks. Before you can assign a LUN to a SAN device: o The VDS hardware provider must be installed on the server. o You must configure connections to the storage device using Storage Manager for SANs.

16 o If the LUN is on an iscsi subsystem, you must configure initiators and targets. o If the LUN is on as FC subsystem, you identify the server, then select the HBA port used for the LUN. o If the LUN points to a cluster, Failover Clustering must be configured. After the LUN is assigned, you can use the wizard to create and format volumes on the storage subsystem. Storage Explorer displays information about the FC and iscsi fabrics detected on your network. With Storage Explorer, you can: Storage Explorer Display detailed information about servers connected to the SAN. Display information about fabric components such as HBAs, FC switches, and iscsi initiators and targets. Perform administrative tasks on iscsi and FC components. For example, you can access the management portal of an FC switch to perform remote management on the switch. Add isns servers and receive information from those servers. The iscsi Initiator is a Windows utility that communicates with iscsi targets. Use the iscsi Initiator to: iscsi Initiator Create and connect to an iscsi target. Enable connection of a Windows host to an external iscsi storage array using Ethernet NICS. Configure a second network adaptor, instead of a dedicated HBA, dedicated to iscsi traffic. Configure discovery and other features of local server connections to iscsi targets.

17 Configure security of local server connections to iscsi targets such as Challenge Handshake Authentication Protocol (CHAP) secrets and IPSec for wire security. Internet Storage Name Service (isns) provides discoverability and zoning of SAN resources. To configure a Windows Server 2008 server as an isns server, add isns as a feature in Server Manager. Adding isns allows the server to: Internet Storage Name Service (isns) Process registration and deregistration requests and queries from isns clients. Provide discovery, management and configuration of Fibre Channel devices using ifcp gateway on a TCP/IP network. Maintain a dynamic database of currently available iscsi devices and related information. Make registered clients aware of changes through the State Change Notification Service. Use Discovery Domain Service, to implement zoning functionality to limit an iscsi initiator to discover iscsi targets only in common discovery domains. Maintain a repository of currently active iscsi nodes and information such as associated portals and entities. Multipath I/O (MPIO) Multipath I/O (MPIO) is a Windows Server 2008/2012/2016 feature that provides support for using multiple data paths to a storage device on Windows. Configuring multiple paths between the server and the storage device provides increased performance for data access and ensures that data is accessible if a single component in the SAN fabric fails. To use MPIO: Install multiple host bus adapters (HBAs) in the server and use SAN hardware (switches and cables) to create redundant paths between devices. Add the MPIO feature through Server Manager.

18 Define MPIO policies to configure how load balancing and failover are performed. Use Storage Manager for SANs (SMfS) to create and manage LUNs on FC and iscsi subsystems that support VDS. Use SMfS to: Storage Manager for SANs (SMfS) Create and manage server connections. Create iscsi targets, configure target security settings, and connect to targets. Assign LUNs to FC and iscsi subsystems. Add Storage Manager for SANs as a feature on Windows Server 2008/2012/2016. Use DiskRAID.exe to manage LUNs in a VDS enabled hardware RAID array using automated scripts or commands from a command line. DiskRAID requires at least one VDS provider installed on the computer. Use DiskRAID to: DiskRAID.exe. Create LUNs and new volumes (simple, striped, mirrored, RAID 5 volumes) Create iscsi targets Extend or add a mirror to an existing volume View information about the iscsi initiator and LUNs Repair fault tolerant LUNs Sergey Gorokhod MCT/MCSE/MCITP/MCTS/MCSA/CCSE/CCSA/CCNA/A+ E mail: sergey@infosec.co.il Mob: (+972)

19 3.7. MPIO Policies MPIO uses load balancing to redistribute read/write requests for the purpose of maximizing throughput between server and storage device. Load balancing is especially important in high workload settings or other situations where consistent service levels are critical. To control how failover and load balancing works, you can define the following policies: Policy Failover Failback Round robin Round robin with Subset Dynamic Least Queue Depth Description Failover uses a single primary path and one or more standby paths. The primary path is used for processing device requests. If the primary path fails, one of the standby paths is used. If multiple standby paths exist, they are listed in decreasing order of preference, with the most preferred path being used first. With the failover policy, load balancing is not performed because only a single path is used at a time. Failback uses a preferred path when that path is functioning. If the preferred path fails, I/O is directed to an alternate path. I/O automatically switches back to the preferred path when it becomes available. Round robin uses all available paths and the load is distributed among all paths. If a path fails, the load is redistributed between all remaining paths. Round robin with Subset configures two sets of paths: a set of preferred paths and a set of standby paths. The preferred set is used until all paths fail. When all preferred paths fail, the standby paths are used. Dynamic Least Queue Depth monitors paths and directs I/O to the path with the least load.

20 Weighted Paths Weighted Paths assigns a weight to each path, with larger weight numbers indicating a lower path priority. I/O is directed to the available path with the least weight. MPIO uses a Device Specific Module (DSM) provided by the hardware vendor. The DSM is a software interface between the multipath driver package and the hardware device. The DSM: Uniquely identifies the device in the multipath system. Specifies the vendor's load balancing policy. This policy determines how the I/O requests are actually routed. Sergey Gorokhod MCT/MCSE/MCITP/MCTS/MCSA/CCSE/CCSA/CCNA/A+ E mail: sergey@infosec.co.il Mob: (+972)