disable multiple initiators connection using targetcli

Question

I have setup iscsi target using targetcli to have some hard drives(block devices), and in "TPG authentication"(a unique useid and passwd for all initiator).

When one initiator does discovery and login, it can access all those devices (sda,sdb,sdc) and format and mount them. But when the second initiator does discovery and login, it can also use (format and mount) all those devices.

Issue: when a drive (e.g. sda) is used by more then one initiator, it will cause conflict in the drive. I also tried "demo mode"(no authentication), and "ACL authentication" (auth per initiator), but none of them will disable the second initiator access.

What I want is: when a drive or an iscsi target is access by one initiator, it should deny the access of the second initiator. And how can I accomplish this using targetcli

Answer 1

Sounds like you effectively want some form of clustering configured with I/O fencing to prevent disks from being mounted on more than one node at a time. If you're intending to share storage between hosts in an active-passive failover scenario, this is the way to do it.

Basically, your disks will be monitored via the clustering software. You'll be able to import and mount them on one node of the cluster (and will prevent you from doing so on other nodes).

The danger situation is "what happens when my heartbeat interconnects go down?" -- that's where I/O fencing comes into play. This involves configuring fencing with quorum disks (which are presented to each node in the cluster). In the event of cluster connectivity loss, the nodes of the cluster race for control of the quorum disks. Whoever wins gets to import the disks. All other nodes will kernel panic. See Shoot The Other Node In The Head for more information and why it's not an overreaction!

Anyways, in terms of practical advice -- I've had a flick through this guide and it seems to describe what you want to do well enough, if you're using a Red Hat based distro. If you're on SLES, Symantec SFHA ships with the vxfen solution. I'm not sure of any solutions for Debian / Ubuntu off the top of my head.