vss-control errors from ESX on iSCSI storage

[jas_smith]

Hello,

I have enabled the notification email on my SAN, but am getting this error:

********************************************************************

ERROR event from storage array 3700-1

subsystem: MgmtExec

event: 7.4.3

time: Tue Sep 9 10:27:10 2008

iSCSI login to target '172.15.242.61:3260, iqn.2001-05.com.equallogic:0-7a0768-c6d3g4102-d5d0000046ac435f2-vss-control' from initiator '172.15.242.40:62955, iqn.1998-01.com.vmware:vmtest01-590fe8b9' failed for the following reason:

Initiator wanted to skip the security phase but we cannot.

********************************************************************

Can I stop ESX connecting, or change that way that it tries to conenct to that volume (vss-control)? Or is there something else I need to do?

Thanks

[christianZ]

That occurs when you enable the VSS functionality on your EQL - do you need it for any windows servers (this is only for windows)?

[jas_smith]

Unfortunately, I will do at the moment. We are going to be having some SQL boxes that connect to the same SAN as the ESX hosts.

I know the errors are not a big thing, but it would be nice to not have them if possible. However, if there is no work around, I guess we need to live with it.

[christianZ · Accepted solution]

How are you configuring vss on Eql, is your Esx host on that list too?

[jas_smith]

No, it currently only have vssuser on that list. Can I just remove that then, and add the ip addresses of the hosts?

[christianZ]

Basically yes but I don't know your full configurations. But you can try it when you don't use it for now.

[jas_smith]

Thanks!

[chrisfmss]

I had te same issue. You have 2 thing to do, first on group configuration - iscsi tab -iscsi discovery - check prevent unauthorized host from discovering target. Second, go to VDS/VSD tab, keep the vds user and add iscsi initiator access retriction for server who want VSS.

[gzcwnk]

I think you mean,

Go into the VDS/VSS tab of the group configuration tab and add a new line by clciking on add, then set un-restricted access for the vmware host(s) as it does not do VSS.

So if you were security checking on iscsi initiator the line would be,

• * iqn.<the esx host's initiator>

This should then stop those annoying alerts every two minutes....

[gzcwnk]

grrrr....

There should be a * for the CHAP user and a * for the IP address, the post above lost a *.

regards