iSCSI on ONTAP deep dive

Where it fits

Also see SAN multipathing, NVMe-oF, and protocol choice.

Provision and map

Create the LUN inside an SVM volume, select a host-aligned OS type, create an igroup, add exact initiator IQNs, then map. ONTAP 9.19.1 documents lun igroup, not bare igroup.

cluster::> lun create -vserver svm_san -path /vol/vol_db/lun01 -size 500GB -ostype linux
Created a LUN of size 500GB.

cluster::> lun igroup create -vserver svm_san -igroup db01 -protocol iscsi -ostype linux
cluster::> lun igroup add -vserver svm_san -igroup db01 -initiator iqn.1994-05.com.example:db01
1 initiator was added.

cluster::> lun mapping create -vserver svm_san -path /vol/vol_db/lun01 -igroup db01 -lun-id 0
cluster::> lun mapping show -vserver svm_san
Vserver  Path                Igroup LUN ID Protocol
svm_san  /vol/vol_db/lun01  db01   0      iscsi

Common OS types include linux, windows, and vmware; check your release and Host Utilities.

Initiator examples

# iscsiadm -m discovery -t sendtargets -p 10.20.30.11
10.20.30.11:3260,1029 iqn.1992-08.com.netapp:sn.abc123
# iscsiadm -m node --login
Login to [10.20.30.11,3260] successful.

PS> iscsicli QAddTargetPortal 10.20.30.11
The operation completed successfully.
PS> Enable-WindowsOptionalFeature -Online -FeatureName MultipathIo
Restart Needed : True

[root@esx01:~] esxcli iscsi software set --enabled=true
[root@esx01:~] esxcli iscsi adapter discovery sendtarget add -A vmhba64 -a 10.20.30.11:3260
[root@esx01:~] esxcli storage core adapter rescan --adapter vmhba64

Use the current NetApp host configuration for validated timeout, MPIO, ALUA, and device settings.

One-way and mutual CHAP

One-way CHAP proves the initiator to ONTAP; mutual CHAP also proves the target. Configure matching secrets on both ends and keep them out of shell history.

cluster::> vserver iscsi security create -vserver svm_san -initiator-name iqn.1994-05.com.example:db01 -auth-type CHAP -user-name db01chap -outbound-user-name ontap-target
Enter the inbound password:
Enter the outbound password:

Fields and mutual-CHAP workflow can vary; check vserver iscsi security create ? on your version.

Sessions, connections, and ALUA

cluster::> vserver iscsi show -vserver svm_san
Vserver Target Name                              Status
svm_san iqn.1992-08.com.netapp:sn.abc123         up
cluster::> vserver iscsi connection show -vserver svm_san
Vserver TSIH Connection ID Initiator Address Target Address
svm_san 7    0             10.20.30.101      10.20.30.11

Build independent paths and let a supported multipath stack use ALUA priorities. Round-robin policy names are host-specific. san config is a host-side NetApp support utility on some platforms, not ONTAP CLI.

Isolation, MTU, and tuning

Use dedicated VLANs/broadcast domains; use IPspaces when separate routing domains are required. Jumbo frames require the same MTU end to end. Queue depth comes from host/interoperability guidance; lun modify is not a generic queue-depth tuner.

cluster::> network interface show -vserver svm_san -data-protocol iscsi
Vserver Logical Interface Address        Home Node Status
svm_san iscsi_a          10.20.30.11/24 node1     up/up
cluster::> network ping -lif iscsi_a -destination 10.20.30.101
10.20.30.101 is alive

Troubleshooting matrix

Official sources

• iSCSI service management
• Configure an SVM for iSCSI
• lun create
• lun igroup create
• lun mapping create
• vserver iscsi security create
• vserver iscsi connection show