user say they have no firewall between the 2 subnets, but I don't trust him exactly. I tested with vrpa connectivity diag tool, use vrpa IP to connect PORT 3260 of esxi hosts, but even esxi1 and esxi2 are failed. So I don't know how to make sure VRPA can communicate with esxi by iscsi protocol.
iSCSI, unlike mgmt connectivity cannot be routed (in vSphere 6.5 it can but it's not recommended). This means that when a single vNIC topology (WAN/LAN and Data are on the same vNIC), vRPAs and VMKs (ESX Management VMKs) must be on the same subnet.
There is a description in RP4VM security guide 5.1, it says that firewall should be configured to let ESXI communicate with VRPA iscsi, I think in this situation , there should be a router between ESXI iscsi and vrpa iscsi to pay firewall role. Do you mean this situation can only happen in ESXi 6.5?
No, the firewall mentioned in the sec conf guide is the ESXi firewall, there should be a rule in the security profile to allow tcp/3260 and iSCSI service must be enabled.
Idan
3 Apprentice
•
675 Posts
0
September 6th, 2017 07:00
Hi there,
Are ESX3/4 on the same cluster as 1 and 2 ?
Regards,
Idan
liuchuanwen
1 Rookie
•
33 Posts
0
September 6th, 2017 08:00
yes, they are on the same ESXI cluster as 1 and 2.
liuchuanwen
1 Rookie
•
33 Posts
0
September 6th, 2017 08:00
and vcenter belongs to 192.168.32.0/24 SUBNET.
liuchuanwen
1 Rookie
•
33 Posts
0
September 6th, 2017 09:00
user say they have no firewall between the 2 subnets, but I don't trust him exactly. I tested with vrpa connectivity diag tool, use vrpa IP to connect PORT 3260 of esxi hosts, but even esxi1 and esxi2 are failed. So I don't know how to make sure VRPA can communicate with esxi by iscsi protocol.
forshr
2 Intern
•
1.1K Posts
0
September 6th, 2017 10:00
Are you using the vSCSI splitter?
Regards,
Rich
Idan
3 Apprentice
•
675 Posts
0
September 6th, 2017 11:00
Hi there,
iSCSI, unlike mgmt connectivity cannot be routed (in vSphere 6.5 it can but it's not recommended). This means that when a single vNIC topology (WAN/LAN and Data are on the same vNIC), vRPAs and VMKs (ESX Management VMKs) must be on the same subnet.
Hope that helps,
Idan Kentor
RecoverPoint Corporate Systems Engineering
@IdanKentor
liuchuanwen
1 Rookie
•
33 Posts
0
September 6th, 2017 17:00
hi Idan,
There is a description in RP4VM security guide 5.1, it says that firewall should be configured to let ESXI communicate with VRPA iscsi, I think in this situation , there should be a router between ESXI iscsi and vrpa iscsi to pay firewall role. Do you mean this situation can only happen in ESXi 6.5?
Idan
3 Apprentice
•
675 Posts
0
September 7th, 2017 05:00
No, the firewall mentioned in the sec conf guide is the ESXi firewall, there should be a rule in the security profile to allow tcp/3260 and iSCSI service must be enabled.