Prevent PVE trying to contact IScsi target through management network

[KrAackers]

Hi,
I got a cluster with two pve nodes in 9.2.2.
Right now, both nodes are connected through ISCSI to two targets.
Node 1 has the following network configuration
vmbr0 10.2.8.4/24 (gateway 10.2.8.254) Management-network
vmbr1 for Vms
vmbr4 10.3.0.4/24 (no gateway) connection to target1 (10.3.0.3)
vmbr6 10.3.6.4/24 (no gateway) connection to target2 (10.3.6.8) (multipathing ok)
vmbr7 10.3.7.4/24 (no gateway) connection to target2 (10.3.7.8) (multipathing ok)

Node 2
vmbr1 10.2.8.10/24 (gateway 10.2.8.254) Management-network
vmbr2 for Vms
vmbr10 10.3.10.10/24 (no gateway) connection to target2 (10.3.10.8) (multipathing ok)
vmbr11 10.3.11.10/24 (no gateway) connection to target2 (10.3.11.8) (multipathing ok)
vmbr12 10.3.12.4/24 (no gateway) connection to target2 (10.3.12.3) (multipathing ok)
vmbr13 10.3.13.4/24 (no gateway) connection to target2 (10.3.13.3) (multipathing ok)

Target1 is a windows server machine
Target2 is a debian machine

The problem I have is that Target 2 is displaying all its IPs (10.3.6.8,10.3.7.8,10.3.10.8,10.3.11.8) to the proxmox initiators causing proxmox to try to reach these IPs the logical way through his management interfaces (because they have a gateway).
I want either the node to stop trying to reach those IPs or to stop my target to broadcast them and force it to show only pertinent IPs to the "right initiators".

Someone got an idea how to do that ?

 

[bbgeek17]

Hi @KrAackers, welcome to the forum.

PVE’s iSCSI discovery logs in to every portal the target advertises in the order they are listed by the Target
The "Behavior B" in our guide covers this: https://kb.blockbridge.com/technote...rage/#connect-all-hosts-to-the-shared-storage

When the target doesn’t report only the right paths, skip pvesm add iscsi. Configure each node manually with iscsiadm -m node -T <iqn> -p <portal>:3260 --login for just the intended portals, and set node.startup to automatic.

To stop Target 2 (Debian) advertising everything, check how its iSCSI target is configured (e.g. LIO/targetcli) and bind each portal to the right network. On the PVE side, you can also add unreachable routes or reject rules for the storage subnets on the management interface, so those attempts fail immediately instead of going out over the management link

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[KrAackers]

Hi @KrAackers, welcome to the forum.

PVE’s iSCSI discovery logs in to every portal the target advertises in the order they are listed by the Target
The "Behavior B" in our guide covers this: https://kb.blockbridge.com/technote...rage/#connect-all-hosts-to-the-shared-storage

When the target doesn’t report only the right paths, skip pvesm add iscsi. Configure each node manually with iscsiadm -m node -T <iqn> -p <portal>:3260 --login for just the intended portals, and set node.startup to automatic.

To stop Target 2 (Debian) advertising everything, check how its iSCSI target is configured (e.g. LIO/targetcli) and bind each portal to the right network. On the PVE side, you can also add unreachable routes or reject rules for the storage subnets on the management interface, so those attempts fail immediately instead of going out over the management link

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

Thanks ! I'll check that out tomorrow and tell you but it looks promising.