1

We are currently running iscsi in an open network and would like to migrate our iscsi to a separate vlan. Reading through the documentation this doesn't seem to be possible. Instead iet/iscsitarget seems to advertise the service on all the IP's of the iscsi target. Since not all of these IP addresses are available on our iscsi initators. Which in turn breaks our xen autostartup during boot (timeout too long).

Restricting the subnet in /etc/iet/initiators.allow and denying all in /etc/iet/initiators.deny doesn't seem to have the desired effect:

# /etc/iet/initiators.allow
ALL 192.168.50.0/24
ALL 192.168.51.0/24

# /etc/iet/initiators.deny
ALL ALL
Improve this question

1 Answer 1

Reset to default
1

I think you should be able to bind your IET target to a specific interface (i.e. your iSCSI VLAN interface) by providing the -a <IPaddress> parameter upon startup.

Setting rp_filter and/or employing iptables rules (more expensive, but necessary if you have routing enabled for your iscsi subnet) should make sure that hosts are not able to reach the iSCSI VLAN target address through other interfaces or out of other subnets.

Improve this answer
4
  • Ietd certainly supports starting with a specific address. Looking at the initscript it's unclear how to set this variable in debian. I certainly don't want to edit any initscripts. How would edit rp_filter solve this problem? Ietd seems to just parse the ifconfig and exports the interfaces.
    – Pascal
    Jan 24, 2012 at 18:01
  • @Pascal I took a glance at the Debian/Ubuntu startup scripts for ietd and it is started as start-stop-daemon --start --exec $DAEMON --quiet --oknodo so obviously there is no parameter to set the IP interface address to bind to - you would have to either edit the original script or derive your own startup script and specify -a. rp_filter and iptables rules would be needed for additional security if you want to ensure that only members of your dedicated storage VLAN subnet are able to access the target on its new address.
    – the-wabbit
    Jan 24, 2012 at 20:42
  • I don't think that this address bind option is going to help. For redundancy and migration, I would like to have the possibility to access ISCSI over both interfaces. I noticed the demon as well. That's why I wrote that I won't edit any initscripts. But I'll report this upstream.
    – Pascal
    Jan 25, 2012 at 13:41
  • Well it seems that I'll have to stick with iptables blocking for now. Since this doesn't seem to be supported.
    – Pascal
    Jun 19, 2012 at 19:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .