iscsi connection show [-v] [ {new | <session_tsih>} <conn_id>]
iscsi initiator show
iscsi interface enable {-a | <interface> ...}
iscsi interface disable [-f] {-a | <interface> ...}
iscsi interface show [-a | <interface> ...]
iscsi isns config -i <ip_addr>
iscsi isns show
iscsi isns start
iscsi isns stop
iscsi isns update
iscsi nodename [<new_nodename>]
iscsi portal show
iscsi security add -i <initiator> -s CHAP -p <inpassword> -n <inname> [ -o <outpassword> -m <outname> ]
iscsi security add -i <initiator> -s { deny | none }
iscsi security default -s CHAP -p <inpassword> -n <inname> [ -o <outpassword> -m <out_name> ]
iscsi security default -s { deny | none }
iscsi security delete -i <initiator>
iscsi security generate
iscsi security show
iscsi session show [-v | -t | -p | -c] [<session_tsih> ...]
iscsi start
iscsi stats [-z]
iscsi status
iscsi stop
iscsi tpgroup add [-f] <tpgroup_name> [<interface> ...]
iscsi tpgroup create [-f] [-t <tpgtag>] <tpgroup_name> [<interface> ...]
iscsi tpgroup destroy [-f] <tpgroup_name>
iscsi tpgroup remove [-f] <tpgroup_name> [<interface> ...]
iscsi tpgroup show
The iscsi command manages the iSCSI service on a filer, and is available only if your filer has iSCSI licensed.
Using the iscsi command, you may set the iSCSI nodename and target alias, and start or stop the iSCSI service, and display initiators currently connected to a the filer. You may also manage iSCSI use of filer network interfaces, configure security parameters, and dump iSCSI statistics.
The nodename and alias subcommands are used to manage the filer's nodename and target alias.
iscsi nodename [<new_nodename>]
Set the iSCSI target nodename of the filer to new_nodename, if specified. Otherwise, display the current iSCSI target nodename of the filer.
iscsi alias [-c | <new_alias>]
Set the iSCSI target alias of the filer to new_alias, if specified. Clear the target alias if the -c option is specified. Otherwise, display the current iSCSI target alias of the filer.
Service State
When the iSCSI service is licensed, the filer administrator
may use the start and stop subcommands to control
whether the filer accepts new incoming iSCSI requests.
iscsi start
Starts the iSCSI service if it is not already running.
iscsi stop
Stops the iSCSI service if it is running; this causes any active iSCSI sessions to be shutdown.
iscsi status
Displays current status of the iSCSI service.
iSCSI Activity
When the iSCSI service is running, the filer is actively
accepting new iSCSI connections and servicing incoming
iSCSI requests from connected initiators. The initiator,
stats, session, and connection subcommands are used to
monitor the filer's iSCSI activity.
iscsi initiator show
Display a list of initiators currently connected to the filer. Information displayed for each initiator includes the Target Session ID Handle (TSIH) assigned to the session, the target portal group number to which the initiator is connected, the iSCSI initiator alias (if provided by the initiator), and the initiator's iSCSI nodename and Initiator Session ID (ISID).
iscsi stats [-z]
Display the current iSCSI statistics. Statistics displayed include the different iSCSI PDU types transmitted and received, SCSI CDB's processed, and various iSCSI errors which may occur.
If the -z option is given, the statistics are zeroed.
iscsi session show [-v | -t | -p | -c] [<session_tsih> ...]
Show status of specified session, or for all sessions if no sessions are specified.
If the -t option is specified, the output contains underlying TCP connection information.
If the -p option is specified, the output contains iSCSI session parameter information.
If the -c option is specified, the output contains information about the iSCSI commands which are in progress on the session.
If the -v option is specified, the output is verbose, and contains all information, including that shown with the -t, -p, and -c options.
Status information displayed includes:
Initiator name, ISID - The iSCSI nodename and iSCSI Initiator Session ID, which combine to identify the initiator using this session.
TCP connections - The local and remote IP addresses, TCP ports, and filer network interface used for each underlying TCP connection. for each connection.
Session Parameters - iSCSI session parameters negotiated via the iSCSI login key exchanges. For specific definitions of these parameters, please see the iSCSI protocol specification.
iscsi connection show [-v] [ {new | <session_tsih>} <conn_id>]
Show status of one connection, or for all connections if no connection is specified. A connection may be one of the connections which compose an active iSCSI session, or it may be a new connection which has not yet completed the iSCSI login sequence.
If the -v option is specified, the output is verbose.
Status information displayed includes:
Connection name - session_tsih/connection_id for connections associated with active sessions; new/connection_num for new connections not yet associated with a session.
Connection state - State of this connection (e.g. Login_In_Progress, Full_Feature_Phase, Shutdown_In_Progress).
TCP connections - The local and remote IP addresses and TCP ports of the underlying TCP connections, and the filer interface used for the connection (verbose mode only).
Network Interface Management
The filer may be accessed as an iSCSI target device over
any or all of the filer's network interfaces. The iscsi
interface command allows the administrator to control
which network interfaces may be used for iSCSI connectivity.
For example, an administrator may wish to configure
a filer to support iSCSI access only through the filer's
Gigabit Ethernet interfaces.
When the iscsi service is enabled, ONTAP will accept iSCSI connections and requests over those network interfaces enabled for iSCSI use via the iscsi interface command, but not over disabled interfaces. When the iscsi service is stopped, ONTAP will not accept iSCSI connections or requests over any interface, regardless of its enable/disable state.
iscsi interface show [-a | <interface> ...]
Show the enable/disable state of the specified interfaces, or of all interfaces if -a is specified. If no arguments are specified, the state of all interfaces is displayed.
iscsi interface enable { -a | <interface> ... }
Enable the specified interfaces for iSCSI service. If -a is specified, all interfaces are enabled for iSCSI use.
Once enabled, new iSCSI connections will be accepted, and iSCSI requests serviced, over the newly enabled interfaces.
iscsi interface disable [-f] { -a | <interface> ... }
Disable the specified interfaces for iSCSI service. If -a is specified, all interfaces are disabled for iSCSI use.
The process of disabling an interface requires termination of any outstanding iSCSI connections and sessions currently using that interface. The command prompts for confirmation if any active sessions will be affected, unless the -f flag is specified.
Once disabled, ONTAP rejects subsequent attempts to establish new iSCSI connections over the newly disabled interfaces.
Target Portal Group Management
As an iSCSI target device, a filer receives iSCSI requests
over any or all of its network interfaces. Each network
interface is assigned to an iSCSI target portal group.
The iscsi tpgroup command is used to manage the assignment of a filer's network interfaces to target portal groups. The administrator may create user-defined target portal groups containing a specific set of filer network interfaces. Any interface which is not part of a user-defined target portal group is assigned by ONTAP to a system default tpgroup.
The administrator should take into account the following factors, imposed by the iSCSI protocol, when assigning interfaces to target portal groups:
1) All TCP connections within an iSCSI session must use interfaces within the same target portal group.
2) A given initiator may have no more than one iSCSI session in progress to the filer through a specific target portal group.
The iscsi portal command may be used to display the list of portals (IP address/TCP port number), and their portal group assignments, over which the filer operates the iSCSI service. The contents of the portal list depends on the enable/disable state and the IP addresses configured on the filer's network interfaces, plus the target portal group assignment for each interface.
iscsi tpgroup show
Display the filer's list of target portal groups, both user-defined and system default.
iscsi tpgroup create [-f] [-t <tpgtag>] <tpgroup_name> [<interface> ...]
Create a user-defined target portal group. If one or more network interfaces are provided, add those interfaces to the group.
If a target portal group tag is specified, that tpgtag is assigned to the created group; otherwise, a tpgtag is automatically assigned.
Reassigning network interfaces may result in termination of sessions already in progress on those interfaces. The command prompts for confirmation if any active sessions will be affected, unless the -f flag is specified.
iscsi tpgroup add [-f] <tpgroup_name> [<interface> ...]
Add interfaces to a user-defined target portal group.
Reassigning network interfaces may result in termination of sessions already in progress on those interfaces. The command prompts for confirmation if any active sessions will be affected, unless the -f flag is specified.
iscsi tpgroup remove [-f] <tpgroup_name> [<interface> ...]
Remove interfaces from a user-defined target portal group. The interfaces are assigned by ONTAP back to their system default tpgroups.
Reassigning network interfaces may result in termination of sessions already in progress on those interfaces. The command prompts for confirmation if any active sessions will be affected, unless the -f flag is specified.
iscsi tpgroup destroy [-f] <tpgroup_name>
Destroy a user-defined target portal group. Any network interfaces which are members of the tpgroup are assigned by ONTAP back to their system default tpgroups.
Reassigning network interfaces may result in termination of sessions already in progress on those interfaces. The command prompts for confirmation if any active sessions will be affected, unless the -f flag is specified.
iscsi portal show
Display the list of target portals (IP address, TCP port number) over which the filer is currently making available the iSCSI service.
Security Parameters
ONTAP supports the configuration of default and per-initiator
authentication parameters; these parameters are
used during the iSCSI connection login phase. Initiators
may be allowed access only after successfully performing
the CHAP authentication procedure; or may be allowed
access without CHAP authentication; or denied access.
iscsi security add -i <initiator> -s CHAP -p <inpassword> -n <inname> [ -o <outpassword> -m <outname> ]
Configure the initiator with CHAP as the authentication method. The -p option is used to specify the inbound CHAP password and the -n option to specify the inbound CHAP username. The -o option is used to specify the outbound CHAP password and the -m option is used to specify the outbound CHAP name. The outbound CHAP password and username are optional and need to be configured if mutual authentication is desired. If the password is not specified on the command line then the administrator is prompted for the password twice.
iscsi security add -i <initiator> -s { deny | none }
Configure the initiator with the authentication method as deny or none. If the authentication method is deny then the specified initiator will be denied access. If the authentication method is chosen as none then no authentication would be done for the specified initiator.
iscsi security default -s CHAP -p <inpassword> -n <inname> [ -o <outpassword> -m <outname> ]
Configure the default authentication method as CHAP. The default authentication parameters apply to any initiator which is not configured with a specific authentication method via the add command.
The -p option is used to specify the inbound CHAP password and the -n option to specify the inbound CHAP username. The -o option is used to specify the outbound CHAP password and the -m option is used to specify the outbound CHAP name. The outbound CHAP password and username are optional and need to be configured if mutual authentication is desired. If the password is not specified on the command line then the administator is prompted for the password twice.
iscsi security default -s { deny | none }
Configure the default authentication method as deny or none. The default authentication parameters apply to any initiator which is not configured with a specific authentication method via the add command.
iscsi security delete -i <initiator>
Remove the initiator from the authentication list. The default authentication would now be applied for this initiator.
iscsi security show
Display the default authentication and all the initiator specific authentication information.
iscsi security generate
Generate a 128 bit Random password that can be used as a CHAP secret.
iSNS Server Registration
ONTAP supports registration with an external iSNS server.
Large-scale installations may choose to use the iSNS mechanism
for centralized management and automatic device discovery.
The iscsi isns command is used to configure and manage the filer's interaction with an iSNS server.
iscsi isns config -i <ip_addr>
Configure the iSNS service with the IP address of the iSNS server. The ip_addr should be entered in dotted quad format. Configuration of the iSNS service should take place before the iSNS service is started.
iscsi isns show
Show the iSNS service configuration. This includes the entity_id_string (EID), the ip_addr of the iSNS server and if the service is enabled.
iscsi isns start
Start the iSNS service. This will start the iSNS service and automatically register with the iSNS server. It is best to configure the iSNS service before starting it.
iscsi isns stop
Stop the iSNS service. This will disable the ability to register with the iSNS server and to be discovered by iSNS clients.
iscsi isns update
Force an update of the registration information with the iSNS server.
filer> iscsi nodename iqn.1992-08.com.netapp:sn.mytarget
Start and stop the iSCSI service:
filer> iscsi start
filer> iscsi stop
Display all initiators currently connected to the filer:
filer> iscsi initiator show
Initiators connected:
TSIH TPGroup Initiator
26 1001 iqn.1992-08.com.vendor:host1 / 00:00:00:00:00:00
Display current iSCSI statistics:
filer> iscsi stats
iSCSI PDUs Received
SCSI-Cmd: 15236 | Nop-Out: 0 | SCSI TaskMgtCmd: 0
LoginReq: 3 | LogoutReq: 1 | Text Req: 1
DataOut: 0 | SNACK: 0 | Unknown: 0
Total: 15241
iSCSI PDUs Transmitted
SCSI-Rsp: 15173 | Nop-In: 0 | SCSI TaskMgtRsp: 0
LoginRsp: 3 | LogoutRsp: 1 | Text Rsp: 1
Data_In: 60743 | R2T: 0 | Reject: 0
Total: 75921
iSCSI CDBs
DataIn Blocks: 1942288 | DataOut Blocks: 0
Error Status: 0 | Success Status: 15221
Total CDBs: 15221
iSCSI ERRORS
Failed Logins: 1 | Failed TaskMgt: 0
Failed Logouts: 0 | Failed TextCmd: 0
Protocol: 1
Digest: 0
Unexpected session disconnects: 0
PDU discards (outside CmdSN window): 0
PDU discards (invalid header): 0
Total: 2
Disable use of a network interface for the iSCSI service:
filer> iscsi interface disable e0
filer> iscsi interface show
Interface e0 disabled
Interface e5 enabled
Interface e11a enabled
Interface e11b enabled
List target portal groups:
filer> iscsi tpgroup show
TPGTag Name Member Interfaces
1000 e0_default e0
1001 e5_default e5
1002 e11a_default e11a
1003 e11b_default e11b
Create a user-defined target portal group with a specific target portal group tag:
filer> iscsi tpgroup create -t 10 dev_tpgroup e11a e11b
List network portal over which the filer is conducting the iSCSI service:
filer> iscsi portal show
Network portals:
IP address TCP Port TPGroup Interface
192.168.10.10 3260 3000 e5
192.168.20.10 3260 4000 e11a
192.168.20.11 3260 4000 e11b
Add initiator iqn.1995-07.com.vendor:host1 to the configuration list with CHAP as the authentication method, pass as the CHAP password, and name as the CHAP name:
filer> iscsi security add -i iqn.1995-07.com.vendor:host1 -s CHAP -p pass -n name
Do not allow access by initiator eui.123456789abcdef0:
filer> iscsi security add -i eui.123456789abcdef0 -s deny
Display the configured security parameters:
filer> iscsi security show
Set the default security method as CHAP with pass as the CHAP password and name as CHAP name:
filer> iscsi security default -s CHAP -p pass -n name
Show the configuration of the iSNS service:
filer> iscsi isns show
iSNS Entity id: entity1
iSNS Server ip-addr: 192.168.1.1
iSNS Status: Enabled
Start or stop the iSNS service:
filer> iscsi isns start
filer> iscsi isns stop
Configure the iSNS service:
filer> iscsi isns config -i 192.168.1.1