iSCSI - Best practices....

[opers13]

routable or non-routable iSCSI VLAN??

[Michael Brown]

An isolated VLAN for iSCSI is not a bad idea, but not a requirement. If the situation permits it, I would use an isolated VLAN for the iSCSI hosts and if needed a separate one for the iSCSI targets. The iSCSI traffic is 100% routable. Best practice would be also to use jumbo frames if the network devices support it.

Hope this helps,

Mike

[alexng]

we do have jumbo frames enabled.

We are just trying to figure out the advantages and disadvantages of routing iscsi. Any security concerns?

[Daniel Barr · Accepted solution]

We route our iSCSI for two reasons:

1. SAN-SAN replication to remote site

2. Management - no dedicated management interface in our arrays without sacrificing one of the iSCSI data transfer port

We do put an ACL on the iSCSI VLAN to restrict traffic to just the needed management ports, and the iSCSI port between the local & remote arrays. That also prevents initiators in servers or wherever from accidentally making a connection over a routed path vs. a dedicated NIC directly on the iSCSI VLAN.

I'd say if you have no replication need, and if your system has dedicated management interfaces, then don't route iSCSI.

[opers13]

just what I was looking for... Thanks!