LinuxIO (LIO) target @ Debian 10 and VMware 6.7 Initiator: Detected WRITE_PROTECTED LUN Access for 0x00000000

Question

we are running

• QNAP NAS
• Debian 10
• Host VMware 6.7U3 Hypervisor

a) Exporting an iSCSI-LUN-target with the QNAP, what ist using LIO therfor, and accessing it from VMware (read/write) works fine.

b) Exporting an iSCSI-LUN-target with a fresh Debian 10 using LIO and accessing it with a Windows 7 iSCSI initiator (read/write) works fine.

Using the target b) (Debian 10 / LIO) and the initiator a) (VMware v6.7) works as far as

• VMware sees the target host
• VMware can login and sees the target
• VMware can READ the data on the LUN (sees partition table, size of it, partition types, etc)

As soon as we try to write anything VMware reports

2020-12-28T14:36:00.775Z info hostd[2098690] [Originator@6876 sub=Partitionsvc opID=esxui-2f96-fbd9 user=root] Status : 255 Output: gpt 0 0 0 0

Error : Error: Read-only file system during write on /dev/disks/naa.60014054b666e78a1c443ee941c60e3e SetPtableGpt: Unable to commit to disk

and the Debian 10 box reports:

kernel: [ 80.210044] TARGET_CORE[iSCSI]: Detected WRITE_PROTECTED LUN Access for 0x00000000

I don't recognize why VMware mounts the iSCSI LUN read-only but Windows 7 mounts it read-write and VMware mount the QNAP-iSCSI-LUN also read-write.

I appreciate any hint - thank you therfor in advance.

PS: maybe someone can create the tag "linuxio" and assign it to this question.

Answer 1

I tried to solve this problem for days, today I x-checked the behavior with Windows 7 and QNAP-NAS. So I had no more idea and asked here for some hints.

Trying für some more hours I recognized that the VMware iSCSI initiator requires an explicit ACL entry while the Windows 7 iSCSI initiator will not.

Be aware that I configured the entire LIO system in demo mode, so no authentication should be needed at all, write protection in demo was off and iqn ACLs should be generated dynamicaly:

cd /iscsi/iqn.2003-01.org.linux-iscsi.v10000.x8664:sn.cce266f35881/tpg1/

set attribute authentication=0 demo_mode_write_protect=0 generate_node_acls=1 cache_dynamic_acls=1

I don't know why it act this way, but Windows 7 worked well w/o an explicit ACL entry and VMware runs fine as I added an ACL entry and a LUN mapping for the initiator under iscsi/iqn..../tpg..../acls/iqn.of-the-initiator

Anyway thanks for reading, maybe this post saves some other admins time.