Masking a VMware LUN

A month ago I passed my VCAP-DCA exam, which I blogged about in this post. And one of the DCA exam topics in the blueprint was LUN masking using PSA-related commands.

Being honest, I can hardly imagine a use case for this as LUN masking is always done on the storage array side. I’ve never seen LUN masking done on the hypervisor side before.

If you have a use case for host LUN masking leave me a comment below. I’d be curious to know. But regardless of its usefulness it’s in the exam, so we have to study it, right? So let’s get to it.

Overview

There are many blog posts on the Internet on how to do VMware LUN Masking, but only a few explain what is the exact behaviour after you type each of the commands and how to fix the issues, which you can potentially run into.

VMware uses Pluggable Storage Architecture (PSA) to claim devices on ESXi hosts. All hosts have one plug-in installed by default called Native Multipathing Plug-in (NMP) which claims all devices. Masking of a LUN is done by unclaiming it from NMP and claiming using a special plug-in called MASK_PATH.

Namespace “esxcli storage core claimrule add” is used to add new claim rules. The namespace accepts multiple ways of addressing a device. Most widely used are:

• By device ID:
  • -t device -d naa.600601604550250018ea2d38073cdf11
• By location:
  • -t location -A vmhba33 -C 0 -T 0 -L 2
• By target:
  • -t target  -R iscsi -i iqn.2011-03.example.org.istgt:iscsi1 -L 0
  • -t target -R fc –wwnn 50:06:01:60:ba:60:11:53 –wwpn 50:06:01:60:3a:60:11:53 (use double dash for wwnn and wwpn flags, WordPress strips them off)

To determine device names use the following command:

# esxcli storage core device list

To determine iSCSI device targets:

# esxcli iscsi session list

To determine FC paths, WWNNs and WWPNs:

# esxcli storage core path list

Mask an iSCSI LUN

Let’s take iSCSI as an example. To mask an iSCSI LUN add a new claim rule using MASK_PATH plug-in and addressing by target (for FC use an FC target instead):

# esxcli storage core claimrule add -r 102 -t target -R iscsi -i iqn.2011-03.example.org.istgt:iscsi1 -L 0 -P MASK_PATH

Once the rule is added you MUST load it otherwise the rule will not work:

# esxcli storage core claimrule load

Now list the rules and make sure there is a “runtime” and a “file” rule. Without the file rule masking will not take effect:

The last step is to unclaim the device from the NMP plug-in which currently owns it and apply the new set of rules:

# esxcli storage core claiming unclaim -t location -A vmhba33 -C 0 -T 0 -L 0
# esxcli storage core claiming unclaim -t location -A vmhba33 -C 1 -T 0 -L 0
# esxcli storage core claimrule run

You can list devices connected to the host to confirm that the masked device is no longer in the list:

# esxcli storage core device list

Remove maskig

To remove masking, unclaim the device from MASK_PATH plug-in, delete the masking rule and reload/re-run the rule set:

# esxcli storage core claiming unclaim -t location -A vmhba33 -C 0 -T 0 -L 0
# esxcli storage core claiming unclaim -t location -A vmhba33 -C 1 -T 0 -L 0
# esxcli storage core claimrule remove -r 102
# esxcli storage core claimrule load
# esxcli storage core claimrule run

Sometimes you need to reboot the host for the device to reappear.

Conclusion

Make sure to always mask all targets/paths to the LUN, which is true for iSCSI as well as FC, as both support multipathing. You have a choice of masking by location, target and path (masking by device is not supported).

For a FC LUN, for instance, you may choose to mask the LUN by location. If you have two single port FC adapters in each host, you will typically be masking four paths per LUN.  To accomplish that specify adapters using flag -A and LUN ID using flags -C, -T and -L.

Hope that helps you to tick off this exam topic from the blueprint.

Advertisement

VCAP-DCA (VDCA550) Exam Experience

I haven’t blogged for a while. But I have an excuse. I’ve been preparing for my VCAP-DCA exam for a few weeks.

I’ve got the results and it’s a pass. So now it’s a good time to fill the gap and make a post about my exam experience.

Preparation

I work as an IT consultant and deal with virtualization, network and storage on a daily basis. Which was an advantage for me as I had a reasonable amount of hands on experience across most of the topics already. So my plan was to research the topics I was weak at and better align my experience with the exam requirements.

The best resource in my opinion is the book called “VCAP5-DCA Official Cert Guide”. It’s published by VMware Press and a resource which you can definitely trust to. The book comes with one practice scenario set, which has 26 questions. I paid for a premium version of the book, which had three sets of practice scenarios.

The only drawback is that the book was originally written for the VDCA510 exam and even thought it has an appendix chapter which discusses the changes in VDCA550, practice scenarios still include only the VDCA510 topics. Which means you’ll have Auto Deploy and vSphere Management Assistant questions, which are no longer in the blueprint. And won’t have vSphere Orchestrator and vSphere Replication questions, which are the new topics in VDCA550. But I still find this book as the best preparation resource so far.

Taking the exam

Time pressure was definitely there. My exam was in the afternoon. I woke up early and flew to Sydney, because there were issues booking the exam in Melbourne. I had a quick lunch in Sydney and went straight to the testing center. I was a bit tired by then, which slowed me down a bit. But I drank a double shot latte, which seemed to compensate for that.

I didn’t find questions too complicated, it really just tested configuration skills, which I practised before sitting for the exam. But you have to practise each and every topic from the blueprint or you’ll fail. I had absolutely no time to browse the docs and didn’t even try to.

I did find some of the questions a bit convoluted, which didn’t state exactly HOW to configure specific things, but more of WHAT you should configure. If that makes sense. But I assume it was intentional and it was maybe only one or two questions and didn’t play a huge role overall.

A piece of advice

Always keep an eye on your time. This is the best advice I can give. The approach I followed was to skim through all questions when the exam started and make short notes on which vSphere feature this question targetes and whether it’s an easy question or hard. I completed all easy questions first and then moved on to the hard ones. This way I made sure that if I ran out of time I would not lose any points on questions I new the answer for.

Not to go into the NDA stuff I will just say that there were a few tasks I simply skipped as I didn’t know the exact steps to complete them and I had no time to make my way through it. But I hit the passing score with 340 points and happy to pass this milestone at first attempt.

If you’re preparing for VCAP-DCA right now, wish you a good luck. Join the ranks!