HP Virtual Connect for c-Class BladeSystem Version 4.01 User Guide Abstract This document contains user information for HP Virtual Connect version 4.01. This document is for the person who installs, administers, and troubleshoots servers and storage systems. HP assumes you are qualified in the servicing of computer equipment and trained in recognizing hazards in products with hazardous energy levels.
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Microsoft® and Windows® are U.S. registered trademarks of Microsoft Corporation.
Contents Introduction .................................................................................................................................. 7 What's new .............................................................................................................................................. 7 Virtual Connect documentation.................................................................................................................... 8 Virtual Connect overview.............................
Managing users ...................................................................................................................................... 65 Local Users screen ......................................................................................................................... 66 Configuring LDAP, RADIUS, and TACACS+ ...................................................................................... 68 Virtual Connect networks .............................................................
Managing server profiles ....................................................................................................................... 178 Define Server Profile screen .......................................................................................................... 178 Server Profiles screen ................................................................................................................... 200 Edit Server Profile screen .....................................................
Domain Status screen............................................................................................................................. 271 Export support information...................................................................................................................... 272 Reset Virtual Connect Manager ............................................................................................................... 273 Recovering remote enclosures ......................................
Introduction What's new The user guide contains information about the following changes in VC 4.01: • Manageability enhancements: o Extended support for FCoE protocol on Flex-10/10D and FlexFabric modules, which includes FIP snooping support but is limited to dual-hop configurations. FlexFabric module dual-hop FCoE support is restricted to uplink ports X1-X4.
• o Ability to set session timeout for idle VCM CLI or VCM GUI management sessions o Protection of VC Enet modules from buffer exhaustion due to flooding of Pause packets from servers VCEM compatibility: o If you are running VCEM 6.3.1 or later to manage a VC 4.01 domain, the 4.01 domain can be in a VCDG in 3.30 firmware mode or later. To enable new features in VC 4.01, you must upgrade to VCEM 7.2 or later. VCEM 7.2 does not support VC versions prior to 3.30.
complex while covering a range of typical building blocks to use when designing Virtual Connect solutions. • HP Virtual Connect Fibre Channel Networking Scenarios Cookbook This guide details the concepts and implementation steps for integrating HP BladeSystem Virtual Connect Fibre Channel components into an existing SAN fabric. The scenarios in this guide are simplistic while covering a range of typical building blocks to use when designing a solution.
VCM is embedded on VC-Enet modules. You can access VCM through a web-based GUI or CLI. The Onboard Administrator provides a web link to the Virtual Connect GUI. The CLI can be accessed remotely through any SSH session or through the Onboard Administrator CLI. The VC modules support the HP BladeSystem c7000 Enclosure, the HP BladeSystem c3000 Enclosure, and all the server blades and networks contained within the enclosure.
HP Virtual Connect Manager Configuring browser support Access to the VCM GUI is provided through HTTPS (HTTP exchanged over an SSL-encrypted session) and requires HTTPS (port 443) to be enabled on the management network. The minimum supported screen resolution is 1024 x 768 with 256 colors. For optimal viewing, HP recommends setting the screen resolution to 1280 x 1024. Requirements The VCM web interface requires an XSLT-enabled browser with support for JavaScript 1.3 or the equivalent.
The recommended Adobe Flash Player web browser plug-in can be downloaded and installed from the Adobe website (http://get.adobe.com/flashplayer/), or downloaded as a standalone executable from the Adobe website (http://www.adobe.com/downloads). For the latest Adobe Flash Player Security Bulletin Updates, see the Adobe website (http://www.adobe.com/support/security/index.html#flashplayer). • Pop-up windows Pop-up windows must be enabled for certain features to function correctly.
VCM typically operates on the primary VC-Enet module unless that module becomes unavailable, causing a failover to the backup VC-Enet module. If you cannot connect to the primary VC-Enet module, try connecting to the management URL for the backup VC-Enet module. • Access the VCM CLI remotely through an SSH session by connecting to the VC-Enet module management IP address. In a multi-enclosure VC domain, VCM runs on the primary module in the primary enclosure.
If the default password for the Administrator user has been changed and needs to be restored, see information about resetting the administrator password and DNS settings in the HP Virtual Connect for c-Class BladeSystem Setup and Installation Guide on the Installing tab of the HP BladeSystem Technical Resources website (http://www.hp.com/go/bladesystem/documentation). Logon problems might be caused by the following: • You have recently upgraded the VCM firmware.
• HP Virtual Connect Manager Fibre Channel Setup Wizard • HP Virtual Connect Manager Server Profile Setup Wizard These wizards can also be launched at any time using the Tools pull-down menu at the top of the GUI. For more information about the setup wizards, see the HP Virtual Connect for c-Class BladeSystem Setup and Installation Guide on the Installing tab of the HP BladeSystem Technical Resources website (http://www.hp.com/go/bladesystem/documentation).
If a red icon with a horizontal white bar appears, an external manager such as VCEM is managing the VCM. Mouse over the icon to display a tool tip with information about the external manager. About HP Virtual Connect Manager To view detailed product information, select About HP Virtual Connect Manager from the Help pull-down menu.
• Network Access Group • Enclosure • Module • Interconnect Bay • Device Bay • IGMP filter • Filter set • FCoE network HP Virtual Connect Manager 17
Menu items The following table lists the items available from the pull-down menu at the top of the screen.
• A close button hides the activity pane for the current GUI session. The activity pane is hidden automatically when the activity state is idle. When the activity pane is hidden, a control appears in the bottom-right corner of the GUI. Click the control to display the activity pane.
Virtual Connect domains Understanding Virtual Connect domains A basic VC domain includes a single HP c-Class BladeSystem c7000 Enclosure for a total of 16 servers (or up to 32 servers if the double-dense option is enabled), or a single HP c-Class BladeSystem c3000 Enclosure for a total of 8 servers (or up to 16 servers if the double-dense option is enabled).
Managing domains Use the following screens to manage the VC domain: • • Domain Settings (Configuration) screen (on page 22) o Change the domain name o Delete a domain o Configure a customized login screen message Domain Settings (IP Address) screen (on page 23) o • • • Set a domain IP address for the VC domain Domain Settings (Enclosures) screen (on page 24) o View enclosures in the domain o Add enclosures to the domain o Remove enclosures from the domain Domain Settings (Backup/Restore)
Domain Settings (Configuration) screen Use this screen to change the domain name, delete a domain, and configure a customized login screen message. To access this screen, click Configuration in the left navigation tree, or select Domain Settings from the Configure menu. Only users with domain role permission can make changes on this screen. The following table describes the available actions in the Domain Settings (Configuration) screen.
CAUTION: Deleting a domain returns all settings to factory default. This action cannot be undone. 1. Power off all servers that are associated with profiles. See "Server Bay Status screen (on page 260)." 2. Navigate to the Domain Settings (Configuration) screen (on page 22). 3. Click Delete. A domain name confirmation window is displayed. 4. Enter the name of the domain to be deleted.
The following table describes the available actions in the Domain Settings (IP Address) screen. Clicking another link in the pull-down menu or left navigation tree causes current edits that have not been applied to be lost. Task Action Use a VC domain IP address Select the box next to Use Virtual Connect Domain IP Address, and then enter the IP Address, Subnet Mask, and Gateway. Save changes Click Apply. Cancel without saving changes Click Cancel.
c-Class BladeSystem Setup and Installation Guide on the Installing tab of the HP BladeSystem Technical Resources website (http://www.hp.com/go/bladesystem/documentation). The following table describes the columns within the Domain Settings (Enclosures) screen.
To add a remote enclosure: 1. Click Find on the Domain Settings (Enclosures) screen (on page 24). 2. Type in the following information: 3. o Onboard Administrator IP Address o Onboard Administrator User Name o Onboard Administrator Password Click OK. IMPORTANT: No more than four enclosures can be found or imported. If an enclosure is unintentionally found, it can be removed by clicking Delete. 4. Click the Import link in the Action column.
Virtual Connect Manager imports the enclosure and provides status information. Removing a remote enclosure To remove a remote enclosure, disassociate all profiles, networks, port sets, and port monitors from the enclosure. If the enclosure is currently in a No-COMM state, the remote enclosure remains in VC Mode. Take the enclosure out of VC mode manually with the OA command line for that enclosure. To remove a remote enclosure: 1. Go to the Domain Settings (Enclosures) screen (on page 24). 2.
Only users with Save Domain Configuration role operation permissions can perform a backup operation. Only users with Restore Domain Configuration role operation permissions can perform a domain restore. For more information, see "Role Management (Role Operations) screen (on page 83)." CAUTION: To avoid loss of data, do not close the browser window containing the VCM GUI during backup or restore operations. If the browser window is closed, you must close and then restart the browser.
3. Select the Ignore firmware version in restored configuration file checkbox to allow restoring a domain configuration from a backup file that was created using a different version of VC firmware. IMPORTANT: Restoring a configuration from a backup file saved by firmware version later than what is currently running is not supported. For example, if you are currently running Virtual Connect v3.60, you can restore a configuration from a backup file that was created using v3.10 or v3.51, but not v3.70. 4.
Column Description IP address iSCSI storage management IPv4 address Username An administrator for the storage management Action Perform edit and delete operations The following table describes the available actions in the Domain Settings (Storage Management Credentials) screen. Clicking another link in the pull-down menu or left navigation tree causes current edits that have not been applied to be lost.
4. Enter the administrator password in the Password field. 5. Re-enter the administrator password in the Confirm Password field. 6. Click Apply.
The SNMP configuration is controlled by VCM and applies to all modules in the VC domain. The SNMP agent software residing on a primary module provides access to managed information using SNMP protocol. The managed information is presented as a hierarchical database called a MIB. Each element of the managed information is identified by a unique identifier called Object ID. Basic SNMP support is provided for both VC-Enet modules and VC-FC modules.
MIB VC-Enet VC-FC VC Domain MIB (VCD-MIB) X — IEEE LLDP MIB (LLDP-MIB) X — IEEE LLDPv2 MIB (LLDPv2-MIB) X — IEEE8023 LAG MIB (LAG-MIB) X — VC QOS MIB (VC-QOS-MIB) X — * Not supported by the HP 8Gb 24-Port FC Module The VC Module MIB is a VC-specific MIB that describes the state of a specific VC module. In addition to unique VC module attributes, it defines traps for reporting alerts on port statistics, such as throughput, errors, and discards.
Trap Category Severity MIB Stale checkpoint VCM Domain Status WARNING VCD-MIB Valid checkpoint VCM Domain Status NORMAL VCD-MIB Enclosure status change (deprecated) — — — vcEnclosureManagedStateChanged VCM Domain Status Corresponds to the VCD-MIB name of the new state — — 3 Network status change (deprecated) — vcEnetNetworkManagedStatusChanged VCM Network Status 3 Fabric status change (deprecated) vcFcFabricManagedStatusChanged 3 Corresponds to the VCD-MIB name of the new state —
IMPORTANT: During OA failover or other management network disruptions, VC SNMP traps might not reach the management station. The VC-FC module generates connUnitPortStatusChange traps based on changes to the connUnitPortStatus element of the FA-MIB. The following table shows the mapping of connUnitPortStatusChange trap severities to the VC Domain MIB's trap severity definitions.
• CRITICAL—The component cannot manage installed VC components. • MAJOR—One or more of the component's subsystems is not operating properly, causing serious disruption to functions. • MINOR—One or more of a component's subsystems is not operating properly, causing slight disruption to functions. • WARNING—The component has a potential problem. • INFO—Operational information on the fully functioning component. • UNKNOWN—VC Manager has not yet established communication with the component.
Trap name Trap data Description vcModPortBpduLoopDetected port identification loop status A network loop condition is detected on this port. If the loop condition is detected on a Flex10 port, the trap data indicates the physical port associated with the Flex10 port. If multiple Flex10 ports on a physical port detect a loop condition, a separate trap is sent for each occurrence of the loop condition. port identification loop status A network loop condition is cleared on this port.
• The Cause string indicates why an object transitioned to the current managed state from the specific objects perspective. A network failure is an example Cause string. • The RootCause string indicates the root causes for an object transitioning managed states. The RootCause for a network failure could indicate all uplink ports of the network have failed. • The ReasonCode provides an object specific reason for the managed state transition.
Enclosure reason code Description vcEnclosureUnknown The condition of the enclosure cannot be determined, or the state of servers or modules is unknown. vcModuleManagedStatusChanged The following is an example of a module Cause string: Port enc0:iobay5:d3:v1 loop detected and automatically disabled The following is an example of a module RootCause string: Port enc0:iobay5:d3:v1 loop detected and automatically disabled The module managed status ReasonCodes are provided in the following table.
The following is an example of a FC fabric RootCause string: 1 of 2 uplink ports are abnormal on BackupSAN fabric The FC fabric managed status ReasonCodes are provided in the following table. FC fabric reason code Description vcFabricOk The fabric is functioning normally. vcFabricNoPortsConfigured The fabric does not have any uplink port configured. vcFabricSomePortsAbnormal Some uplink ports for the fabric are in an abnormal condition.
VC domain checkpoint traps The domain checkpoint trap indicates configuration changes have been saved in non-volatile memory and copied (check-pointed) to the horizontally adjacent module. vcCheckpointTimeout The checkpoint valid status remained false for more than five minutes. vcCheckpointCompleted A checkpoint operation has completed following a checkpoint timeout trap. The checkpoint valid status is true again.
The VC-Enet SNMP settings apply to all VC-Enet modules in the Virtual Connect domain. The following table describes the fields within the SNMP Configuration screen. Field name Description Enable SNMP Select to enable SNMP. System Contact Specify a contact name for this system when SNMP is enabled. Read Community Controls SNMP read access when SNMP is enabled. The default value for read community string is "public". The read community string must always be set when SNMP is enabled.
Task Action Add an SNMP trap destination ("Adding an SNMP trap destination" on page 43) Click Add below the destination table, or right-click on the header row of the destination table, and then select Add Destination. Edit an SNMP trap destination Click Edit in the Action column, or right-click on the trap destination row, and then select Edit Destination. Delete an SNMP trap destination Click Delete in the Action column, or right-click on the trap destination row, and then select Delete Destination.
If you enter information that is invalid (for example, if you use a space in the Destination name), a red box appears around that field. Mouse over the box to see information regarding the error. Select trap categories Selecting a trap category allows multiple traps to be enabled or disabled as a group. To select trap categories, click the checkbox. For VC-FC modules, selecting either the Port Status or Other checkbox results in all SNMP traps being sent to the trap destination.
If you enter information that is invalid (for example, if you use a space in the IP address), a red box appears around that field. Mouse over the box to see information regarding the error. SNMP Configuration (VC-FC) By enabling SNMP for VC-FC modules, network management systems can monitor the VC-FC modules in the domain for events, such as warnings and errors, which might require corrective actions. You must have storage or domain role permission to administer FC SNMP settings.
Field name Description System Contact Specify a contact name for this system when SNMP is enabled. The maximum length is 20 characters. Read Community Controls SNMP read access when SNMP is enabled. The default value is "public". The read community string must always be set when SNMP is enabled. The maximum length is 24 characters.
For the HP VC 8Gb and 4Gb 20-port FC modules, SMI-S is supported.
Click Refresh to display the most current information. System Log entry format A wide variety of events are generated by Virtual Connect and logged into the System Log, or SysLog. The remote logging capability is supported using the syslog protocol defined in RFC 3164. The remote logging feature also provides an option for transmission over TCP and secure transmission support using stunnel.
• The event severity is Info (informational). • The event message is VCM user logout : Administrator@16.85.18.209. The following table describes the Virtual Connect managed objects that are capable of generating System Log events, along with the corresponding event ID ranges.
System Log (Configuration) screen Use this screen to view or set remote log destination settings. Column Description Log host The IP address or the DNS of the configured remote log destination Log severity Severity of the log messages that should be sent to the specified destination. Valid values include "Critical", "Error", "Warning", and "Informational". Transport The transport protocol to be used for sending the log messages to the destination. Valid values include "TCP" and "UDP".
To delete a remote log destination, select the checkbox next the preferred destination, and then click Delete.
On initial startup, VCM generates a default self-signed SSL certificate valid for 10 years, and the certificate is issued to the DNS name of the VC-Enet module (the dynamic DNS name from the Default Networks Setting label). Because this default certificate is self-signed, the "issued by" field is also set to the same DNS name. If VCM is configured with a VC domain IP address, then future certificate requests generated will reflect this domain IP address.
Row Description Valid until The date and time when this certificate becomes invalid Serial Number Serial number of the certificate. This serial number is unique per Certificate Authority that issued it. Version Version of the certificate MD5 Fingerprint Unique fingerprint of the certificate, calculated using cryptographic hash function Message-Digest algorithm 5 (MD5). This fingerprint can be used to further verify that the correct certificate is being used.
SSL Certificate Administration (Certificate Signing Request) screen This screen allows a certificate request to be generated for the domain if the existing certificate has a Key Length of 2048. If the key for the existing certificate is not 2048 bits, a warning appears requiring that the key be updated before you can enter data or generate a signature request.
The following table describes the fields on the SSL Certificate Administration (Certificate Signing Request) screen. Clicking another link in the pull-down menu or left navigation tree causes current edits that have not been applied to be lost. Field Possible values Description Required Information Country (C) State or Province (ST) Must be a two character country The two character country code that identifies code. Only alphabetic characters the country where the VC domain is located are allowed.
Field Possible values Description Alternative Name 0 to 500 characters in length Alternative identifiers for the VC domain that the certificate should also cover. Examples include DNS names and IP addresses.
When renewing certificates, the upload removes any previous Signed Certificate from VCM. You must add a new certificate or update with a renewed certificate in your browser. See browser Help for information on installing or renewing certificates. SSH Key Administration screen This screen lists the current user (assuming administrator privileges) of each authorized SSH key and enables the user to add new keys. Only local users can have authorized SSH keys.
After you have authorized one or more SSH keys, you can delete all of them by clicking Clear SSH Keys. Removing the authorized SSH keys does not affect current SSH sessions. Web SSL Configuration screen This screen enables you to change the currently configured SSL encryption strength. This screen is only available to users with domain user role permission.
When the web SSL encryption strength is changed, logged in users are notified that they must reconnect.
HP BladeSystem c-Class enclosures Enclosure serial numbers The enclosure serial number is used by the Virtual Connect Manager to associate a Virtual Connect domain with a particular enclosure. The enclosure serial number can be altered for maintenance purposes, such as replacement of the enclosure midplane.
The management interfaces for all enclosure Onboard Administrators and VC modules within the same VC domain must be on the same lightly loaded subnet and highly reliable network. Overloads or loss of connectivity can disable configuration attempts until the connectivity is re-established and synchronized with the domain. The Onboard Administrator IP addresses used must be configured to be static.
For more information, see the HP Virtual Connect for c-Class BladeSystem Setup and Installation Guide on the Installing tab of the HP BladeSystem Technical Resources website (http://www.hp.com/go/bladesystem/documentation). Enclosures View screen This graphical representation consists of an enclosure front view and rear view. To display a window with information about a particular device, mouse over that device in this graphical view. The Enclosures view provides status on each device in the enclosure.
Enclosures view (multiple enclosures) When more than one enclosure has been imported, each enclosure is displayed on the Enclosures View screen.
Virtual Connect users and roles Understanding VC administrative roles Each user account can be set up to have a combination of up to four user role permissions: • • • • Domain o Define local user accounts, set passwords, define roles o Configure role-based user authentication o Import enclosures o Name the VC domain o Set the domain IP address o Administer SSL certificates o Delete the VC domain o Configure SNMP settings Network o Configure network default settings o Select the MAC a
o Update firmware o Save configuration to disk o Restore the configuration from a backup It is possible to create a user with no user role permissions. This user can only view status and settings.
Local Users screen The first time this screen appears, the Administrator account, which has all administrative user role permissions, might be the only user listed. The Administrator account cannot be deleted or have domain user role permissions removed. However, the Administrator password can be changed, and the network, server, and storage user role permissions can be removed. The default Administrator password is identified on the Default Network Settings label on the primary VC module.
o Non-alphanumeric character Click Apply to save your changes. • To set a session timeout period, enter a number between 10 and 1440 in the Session Timeout box. To disable a session timeout period, enter 0. Click Apply to save your changes. Any change in the timeout value affects all open sessions and is applied to new sessions. • To edit the delete confirmation preference, select or clear Auto Populate Name During Delete Confirmation, and then click Apply.
Adding a new user Observe the following user settings guidelines: • Username is a required field. • The Username field must contain an alpha-numeric value with 1 to 31 characters. • The Password field must contain an alpha-numeric value with 3 to 40 characters. The default password length is 8 characters.
For LDAP authentication, the VCM contacts and external LDAP server on which user accounts have been set up. During login, VCM sends an authentication request to the server and waits for a login accept or login reject response from the server. RADIUS and TACACS+ provide remote user authentication. At login, an external RADIUS or TACACS+ server is contacted by the VCM to authenticate the user login.
Local users can test an LDAP configuration before applying it. For more information, see "Test LDAP authentication (on page 70)." The following table describes the fields within the LDAP Server Settings (LDAP Server) screen. Clicking another link in the pull-down menu or left navigation tree causes current edits that have not been applied to be lost. Field Description Enable LDAP Authentication Select to enable LDAP authentication.
2. Be sure that any LDAP certificates are installed. 3. Access the LDAP Server Settings (LDAP Server) screen. 4. Enter the LDAP configuration information. 5. Click Test. The LDAP Configuration Test screen appears. 6. Enter a valid user name and password. 7. Click Test. The status window displays any problems encountered during the test. When testing is complete, click Close. LDAP Server Settings (LDAP Groups) screen Use this screen to manage the LDAP Group settings for VCM.
The following table describes the fields within the LDAP Server Settings (LDAP Groups) screen. Field Description Group Name The Directory Server group name. Microsoft Active Directory servers have a reverse mapping from the user to the groups the user belongs to. To determine if the user is a member of the group, other servers might need to combine the Group Name with a Search Context to look up the group. To open the Edit LDAP Group window, click the Group Name. Starting with Virtual Connect v1.
Field Description Description A text description for the group. Roles Select zero or more roles (Domain, Network, Storage, Server) to assign to the group. When a role is selected, the operations for the selected role have a checkmark next to them. Role operations can be edited from the "Role Management (Role Operations) screen (on page 83)." To add the new group, click Add. LDAP Server Settings (LDAP Certificate) screen Use this screen to manage LDAP server certificates.
Column Description Version Version of the certificate Valid From The date and time when this certificate became valid Valid To The date and time when this certificate becomes invalid Delete Click X in the line of the certificate to delete. RADIUS Settings (RADIUS Server) screen This screen enables domain administrators to configure a RADIUS server to authenticate users accessing the CLI or GUI based on user name and password and to provide role-based authorization.
Field Description Add/Remove Secondary Server Select to add or remove a secondary RADIUS server. To add a secondary server, select the Add/Remove Secondary Server checkbox to display the Secondary Server Parameters, complete the fields as described in the table above, and then click Apply. The secondary server is queried only if the primary server is down or the request to the primary server times out. To remove a secondary server, clear the Add/Remove Secondary Server checkbox, and then click Apply.
} nastype = other The RADIUS server ignores authentication requests from an unknown client. Therefore, if the client entry is absent, the server ignores it. The server does not send a reject response. 4. Add the following to the dictionary file /usr/local/share/freeradius/dictionary.hp for HP: ATTRIBUTE HP-VC-groups 192 string HP The RADIUS server logs are available in the logfile /usr/local/var/log/radius/radius.log.
RADIUS Settings (RADIUS Groups) screen Use this screen to manage the RADIUS Group settings for Virtual Connect Manager. The following table describes the fields within the RADIUS Settings (RADIUS Groups) screen. Field Description Group Name The RADIUS group name. Roles Zero or more roles (Domain, Network, Storage, Server) assigned to the group. A user can be a member of multiple groups, in which case the roles are cumulative.
Add or Edit RADIUS Group Use this screen to add or edit a RADIUS Group. The following table describes the fields within the Add/Edit RADIUS Group screen. Field Description Group Name This is the group name value configured as the vendor-specific attribute HP-VC-Groups on the RADIUS server. The name can consist of 1 to 255 standard text-string characters (alphanumeric characters, hyphen (-), underscore (_), period (.)) except backslash (\) and single quote ('). You cannot change the name on edit.
Users with domain user role permissions can test a TACACS+ configuration before applying it. For more information, see "Test TACACS+ authentication (on page 81)." The following table describes the fields within the TACACS+ Settings screen. Clicking another link in the pull-down menu or left navigation tree causes current edits that have not been applied to be lost. Field Description Enable TACACS Authentication Select to enable TACACS+ authentication.
To remove a secondary server, select the Add/Remove Secondary Server checkbox to display the Secondary Server Parameters, clear the fields, and then click Apply. Required TACACS+ server settings The following TACACS+ server settings must be configured on VC to enable TACACS+-based authentication: • Enable or disable flag • TACACS+ server IP address • Server SSL port number—the default (well-known) value for TACACS+ authentication is 49.
group = ALL_STAFF { } # End config file The server logs can be accessed on the TACACS+ server at /var/log/tac_plus.log. The accounting log is available under /var/log/tac_plus.acct, which records all command logging requests. Test TACACS+ authentication Users with domain user role permissions can test their TACACS+ configuration before making the configuration active. To test a TACACS+ configuration: 1. Access the TACACS+ Settings screen (on page 78). 2. Enter the TACACS+ configuration information. 3.
Role Management (Role Authentication Order) screen Use this screen to specify the authentication services to be used during log in and set the order in which each authentication method is queried for each role. Role authentication order is followed for role-prefixed logins only, such as "domain:user1".
Role Management (Role Operations) screen Use this screen to change the role operations allowed for Network, Server, Storage, and Domain roles. You must have Domain Administrator role permission to make these changes. Changes apply to all users assigned to a given role. For example, if the Domain Administrator changes the role operations to allow Network users to export support files, all Network users are able to export support files.
Virtual Connect networks Understanding networks and shared uplink sets The VC-Enet modules use standard Ethernet bridge circuitry with special firmware so that they function as a configurable Ethernet port aggregator. For a specific external data center connection, only the selected server Ethernet NIC ports are visible on what appears to be an isolated, private, loop-free network.
Identifying an associated network as the native VLAN causes all untagged incoming Ethernet packets to be placed onto this network. Only one associated network can be designated as the native VLAN. All outgoing Ethernet packets are VLAN-tagged. To enable native VLAN when defining a shared uplink set, select the box under Native. To enable or disable native VLAN on an existing network, go to the Edit Shared Uplink Set screen (on page 131).
The following figure shows tunneled VLAN tags. On the dedicated, green network, both uplink and server VLAN tags are tunneled through Virtual Connect unchanged. On the shared, red and blue networks, uplink VLAN tags are mapped to networks. Untagged frames are mapped to the native VLAN, if present, otherwise they are dropped. Server frames are untagged only, and tagged frames are dropped. Each server port is connected to a single network.
• • Ethernet Settings (Advanced Settings) screen o Set Server VLAN Tagging Support o Set VLAN Capacity o Use the Multiple Networks Link Speed Settings to set a custom value for preferred link connection speed or maximum link connection speed o Enable or disable MAC Cache Failover o Modify the refresh interval for MAC Cache Failover o Enable or disable network loop protection for all VC-Enet modules in the domain o Reset network loop protection for all server ports in a loop-detected error sta
o Edit a server profile o Define a new network o Illuminate the PID for all uplink ports associated with a network Network Access Groups screen Before VC 3.30, any server profile could be assigned any set of networks. If policy dictated that some networks should not be accessed by a system that accessed other networks (for example, the Intranet and the Extranet) there was no way to enforce that policy automatically. With VC 3.
The following table describes the available actions in the Network Access Groups screen. Task Action View networks that are members of a network access group Click the network access group name. Filter the list of networks in a network access group On the Alphabetic tab, click a letter to show only network names that begin with that group of letters, or click All to show all networks alphabetically. On the Filter tab, use the pull-down menus to select the networks you want to view, and then click Go.
o On the Alphabetical tab, click a letter to show only network names that begin with that group of letters, or click All to show all networks alphabetically. o On the Filtered tab, use the pull-down menus to define the filter criteria, and then click Go. 3. Drag and drop the networks that should be included as members of the network access group from the Excluded Networks field to the Included Networks field. 4. Click Apply.
3. Drag and drop the networks that should be included as members of the network access group from the Excluded Networks field to the Included Networks field. 4. Drag and drop the networks that should not be included as members of the network access group from the Included Networks field to the Excluded Networks field. 5. Click Apply. Ethernet Settings (Port Monitoring) screen To access this screen, do one of the following: • Under Ethernet Settings in the left navigation tree, click Port Monitoring.
If port monitoring is configured and enabled within the Virtual Connect domain, Ethernet data from the monitored ports is replicated on the network analyzer port, which poses a security risk and could result in network loops if not connected properly. The following table describes the fields within the Ethernet Settings (Port Monitoring) screen. Field name Description Port Monitoring State Used to enable or disable port monitoring.
The following table describes the available actions in the Ethernet Settings (Port Monitoring) screen. Clicking another link in the pull-down menu or left navigation tree causes current edits that have not been applied to be lost. Task Action Enable or disable port monitoring Click the pull-down box under Port Monitoring State. A network analyzer port is required to enable or disable the port monitoring state. Select a mirror-to port Click the Select Port down arrow.
Select Monitored Ports screen The Select Monitored Ports screen appears when you click the Select Ports button on the Ethernet Settings (Port Monitoring) screen. You can select up to 16 server ports to monitor. Although you can select individual FlexNICs as monitored ports, VCM mirrors traffic on a physical port basis. To filter the list of ports, select one or more of the boxes at the top of the screen. The following table describes the available actions in the Select Monitored Ports screen.
Task Action Accept selected ports and return to the Port Monitoring screen Click OK. Clear newly selected ports without saving and return to the Port Monitoring screen Click Cancel. Reset the filter criteria to include all items in each filter Click Reset Filters. Ethernet Settings (Advanced Settings) screen Use this screen to perform the following tasks: • Set Server VLAN Tagging Support (on page 96). • Set VLAN Capacity (on page 97).
Only users with network role permissions can change this screen. Server VLAN tagging support VLAN tunneling support You can tunnel VLAN tags and map VLAN tags in the same domain. As of VC 3.30, tunneling and mapping is configured at the network level, not at the domain level. Server VLAN tunneling is supported only on networks with dedicated uplinks and cannot be used with shared uplink sets.
when creating or editing a profile. When this check box is selected, server network connections can only be selected from a single shared uplink set. When the 'Force server connections to use same VLAN mappings as shared uplink sets' check box is not selected, server network connections can be selected from any VC Ethernet network and the external VLAN ID mappings can be manually edited. However, administrators must ensure that no server connection VLAN ID conflict exists.
o Set maximum connection speed. This value is the maximum speed for server profile connections mapped to this network. This speed limits the maximum port speed from the server to the network connection associated with the multiple networks. Click Apply. Virtual Connect can only control link speed for Flex-10 NICs when they are connected to an HP Virtual Connect Flex-10 Module. Virtual Connect cannot control the link speed of traditional NICs. For more information, see "Flex-10 overview (on page 163).
Enhanced network loop protection detects loops on downlink ports, which can be a Flex-10 logical port or physical port. The feature applies to Flex-10 logical function if the Flex-10 port is operating under the control of DCC protocol. If DCC is not available, the feature applies to a physical downlink port. Enhanced network loop protection uses two methods to detect loops: • It periodically injects a special probe frame into the VC domain and monitors downlink ports for the looped back probe frame.
VC provides the ability to monitor server downlink ports for pause flood conditions and take protective action by disabling the port. The default polling interval is 10 seconds and is not customer configurable. VC provides system logs and SNMP traps for events related to pause flood detection. This feature operates at the physical port level. When a pause flood condition is detected on a Flex-10 physical port, all Flex-10 logical ports associated with physical ports are disabled.
Task Action Enable/disable Select (enable) or clear (disable) the Enable Throughput Statistics checkbox. Change sampling rate Select a sampling rate from the Configuration list. Supported sampling rates include: • • • • • • Sample Sample Sample Sample Sample Sample rate rate rate rate rate rate of of of of of of 1 2 3 4 5 1 minute, collecting up to 5 hours of samples. minutes, collecting up to 10 hours of samples. minutes, collecting up to 15 hours of samples.
The following diagram illustrates how VC receives traffic and categorizes it into classes. Packets can be reordered based on priority as shown for packet number 3. Packets can also be dropped during congestion as shown for packet number 5. Prior to the VC 4.01 release, VC QoS support was limited apart from dynamic Max rate limiting bandwidth control. VC Ethernet modules passed Layer 2 and Layer 3 markings in VLAN tunnel mode but in some cases removed L2 markings in mapped mode.
To access this screen, do one of the following: • Under Ethernet in the left navigation tree, click Quality of Service (QoS). • On the home page, in the Network section, click Quality of Service (QoS). • On the home page, click Configure, and then select Quality of Service (QoS). The QoS screen is accessible to all users with network or domain role permissions. All other users have read-only access.
Traffic Classes A traffic class allows you to categorize packets requiring similar traffic management. The following table describes the columns on the traffic class screen. Clicking another link in the pull-down menu or left navigation tree causes current edits that have not been applied to be lost. Item Description Name Name of the traffic class. Real Time One user-defined class can be designated as real time.
Action Description Edit the Share for a traffic class Click on the number in the Share column, and then type in a new number. Click Apply. Edit the Max Share for a traffic class Click on the number in the Max Share column, and then type in a new number. Click Apply. Edit the egress DOT1P priority for a traffic class Click on the number in the Max Share column, and then select a new number from the pull-down list.
to 802.1p egress priorities to be set on packets before they are placed on an egress queue. Virtual Connect retains and obeys L2 markings on tunneled vNets without applying any changes to them. To change the traffic class for an Ingress DOT1P Value or Ingress DSCP Value, select a traffic class from the drop-down list, and then click Apply. To reset the QoS configuration to default values, click Reset, and then click Apply.
Item Description Max Share Maximum share that the traffic class can use when other traffic classes are not using their maximum share. Egress DOT1P Priority The egress dot1p priority marking on the VLAN tag. Enabled The FCoE Lossless and Best_Effort classes are enabled by default. Other classes are enabled if the checkbox in the Enabled column is selected. Click Reset, and then click Apply.
Ingress Traffic Classifiers The Classification for uplinks and Classification for downlinks pull-down lists allow you to choose what classification method is applied to traffic in the specified direction. The default classification for uplinks is DOT1P. The default classification for downlinks is DSCP/DOT1P. When both DOT1P and DSCP are being used for one traffic flow, DSCP is used for IP traffic and DOT1P is used for non-IP traffic.
IGMP Settings (IGMP Configuration) screen From this screen you can do the following: • Enable or disable IGMP Snooping (on page 111, "IGMP Settings (IGMP Configuration) screen" on page 109) • Modify the idle timeout interval for IGMP Snooping • Allow or prevent flooding of unregistered IGMP multicast traffic • Monitor and manage multicast group membership for hosts subscribing to IGMP multicast traffic • Manage new Multicast Filter rules for a Multicast filter ("Multicast Filtering" on page 112)
The following table describes the available actions in the IGMP Settings (IGMP Configuration) screen. Clicking another link in the pull-down menu or left navigation tree causes current edits that have not been applied to be lost. Task Action Filter the entries in the table Click Filter, use the pull-down menus to select the filter you want to view, and then click Go.
4. (Optional). Select a color to assign the multicast filter. 5. Create one or more multicast filter rules to specify an IGMP multicast group IP address for which access is permitted (maximum 32 rules per filter): a. Enter a Multicast IP Address in the form of IP Address/Netmask Bits. For example, 224.10.0.0/16. The IP Address must be unique and should be the starting address of an IP subnet. b. Click Add. 6.
The IGMP Snooping idle timeout interval is set to 260 seconds by default. This value is the "Group Membership Interval" value as specified by IGMP v2 specification (RFC2236). For optimum network resource usage, set the interval to match the configuration on the customer network's multicast router settings. By default, unregistered IGMP multicast traffic traversing VC-Enet modules is flooded on the configured Ethernet network.
• Any other L2 multicast traffic is forwarded to all VC ports in the network. With multicast filters configured for profile connections (IGMP Snooping must be enabled to use multicast filters): • Multicast traffic for registered groups is forwarded to all member ports. • Unregistered multicast traffic is flooded to all VC ports on the configured VLAN by default. The “No Flood feature” should be enabled to prevent flooding of unregistered multicast traffic.
4. (Optional) Enter a label for the set. 5. Drag and drop multicast filters that should be members of the filter set from the Excluded filter set field to the Included filter set field. 6. Click Apply. To edit a multicast filter set: 1. Click on the set to edit. 2. Make any changes. 3. Click Apply. A multicast filter can be removed from a multicast filter set, or a filter rule can be deleted from a multicast filter while it is associated with a profile Ethernet connections.
Field name Description Labels A network can have up to 16 user-defined labels to group and identify the network within VCM. Smart Link (on page 85) To enable Smart Link, edit the network settings after the network is created. The checkbox is not available until an uplink is added to the network. Private Network ("Private Networks" on Select whether to designate (checked) or not designate (unchecked) this network as a private network.
Task Action connection speed or maximum link connection speed see "Advanced Network Settings (on page 118)." Set the Connection Mode Select Auto or Failover. For a description of these modes, see "Defining a network (on page 116)." Set the LACP Timer Select the duration for the LACP Timer ("LACP timer configuration" on page 101).
9. Select the speed and duplex (where applicable) of the uplink ports. Click the pull-down box under Speed/Duplex, and then select a setting. Half-duplex operation is not supported by the VC-Enet module. IMPORTANT: Be sure that the uplink interface port speed matches the speed set on the corresponding network switch port. If using autonegotiation, both ports must be configured to use autonegotiation or they might not link. 10.
Advanced Network Settings These settings affect only newly created profiles. Versions of VC prior to v4.01 used the "preferred speed" to control bandwidth allocation. When existing profiles are upgraded to VC v4.01, the "maximum speed" from the network is set automatically on the connection. If no maximum speed was configured prior to the upgrade, then the maximum speed will be 10 Gb for Ethernet connections and 8Gb for FCoE connections. The pre-4.
• Click a network on the Interconnect Bay Summary screen ("Ethernet Bay Summary (General Information) screen" on page 233). • Enter a network name in the Find Configuration Items search field in the left navigation tree, and then select the network. Use this screen to edit the properties of an existing network or to delete a network. This screen has similar fields to the Define Ethernet Network screen (on page 114).
Field name Description External Uplink Ports Shared Uplink Set/External VLAN ID/Native VLAN These options are only available if there are shared uplink sets defined. For more information, see “Shared uplink sets and VLAN tagging (on page 84)." Port Network port locations (enclosure, bay, and port numbers) Port Role Applicable when Failover Connection Mode is selected. The port can be designated as Primary or Secondary. Port Status Shows the link status, link speed, and connectivity of the port.
Task Action Change the connection mode Click the down arrow in the box next to Connection Mode, and then select Auto or Failover. For a description of these modes, see "Defining a network (on page 116)." Delete an added port Click the Delete link in the Action column, or left-click the port to select it, right-click to display a menu, and then select Delete.
The following table describes the columns within the summary table on the Ethernet Networks (External Connections) screen. Column name Description Ethernet Networks Shows the overall network status and network name Type Displays the type of network (ENET or FCOE) PID Shows whether the PID is on or off for the port Shared Uplink Set (VLAN ID) Shows the name of the shared uplink set and its VLAN ID (if applicable) Overall Port Status Shows the link status, link speed, and connectivity of the port.
This summary screen lists the server ports connected to each network in the Virtual Connect domain. This screen is viewable by all authorized users. The following table describes the columns within the Ethernet Networks (Server Connections) screen.
Managing shared uplink sets Use the following screens to manage shared uplink sets: • Define Shared Uplink Set screen (on page 124) o • • • Define a shared uplink set Edit Shared Uplink Set screen (on page 131) o Edit the properties of an existing shared uplink set o Add or delete an associated network Shared Uplink Sets (External Connections) screen (on page 134) o View a list of external shared uplink connections o Add a shared uplink set o Edit a shared uplink set o Delete a shared upli
In VC 3.30 and later, there is a limit of 1000 networks per VC domain. Additionally, the VLAN Capacity (on page 97) might place restrictions on the number of networks that can be added to a shared uplink set. The following table describes the fields within the Define Shared Uplink Set screen. Field name Description Ethernet Shared External Uplink Set Uplink Set Name Descriptive name for the shared uplink set. Do not use spaces.
Field name Description Connection Mode Connection mode of the uplink ports for this network. For a description of the connection modes, see "Defining a network (on page 116)." This setting cannot be changed for shared uplink sets with an associated FCoE network. LACP Timer If the connection mode is set to Auto, displays the default LACP timer setting for the domain. Associated FCoE Network (VLAN tagged) Allows the addition of an FCoE network to the shared uplink set.
Task Action network Set a custom value for preferred Select the Advanced Network Settings checkbox. link connection speed or maximum link connection speed Click the Edit link in the Action column, or left-click to select an associated Edit associated network network, right-click to display a menu, and then select Edit.
o Short—If this mode is selected, VC requests short (every 1 second) LACP control messages on a LAG that is formed with the uplink ports. o Long—If this mode is selected, VC requests long (every 30 seconds) LACP control messages on a LAG that is formed with the uplink ports. 6. Create the associated FCoE networks that will use this shared uplink. For more information, see "Defining an FCoE network (on page 129)." 7. Create the Associated Networks that will use this shared uplink: a.
Set preferred connection speed. This value is the default speed for server profile connections mapped to this network. The server administrator can override this setting on an individual profile connection. Set maximum connection speed. This value is the maximum speed for server profile connections mapped to this network. This speed limits the maximum port speed from the server to the network connection associated with the multiple networks. 8. Click Apply.
The following figure shows a high-level topology configuration using an HP 5820-14XG ToR 10GbE Switch: Restrictions • No congestion notification (QCN) support is implemented. Only direct connections between VC modules and external FCoE bridge ports are supported. • Only one FCoE network can be associated with any single set of uplink ports. • FCoE traffic does not cross stacking links and a configuration using uplinks from different bays is not allowed. • FCoE is not supported on c3000 enclosures.
5. To add labels to the network, type a label in the Labels field, and then press Enter. Labels are used as text-based identifiers for the network within VCM. Each label can contain up to 24 characters, excluding spaces. Each network can have up to 16 labels. 6. To set the preferred or maximum connection speed, select the Advanced Network Settings checkbox. To change these settings: a. Click the selection box. b. Select a setting (100Mb to 10Gb): — Set preferred connection speed.
Use this screen to edit the properties of an existing shared uplink set, add an associated network, or delete an associated network. This screen has the same fields as the Define Shared Uplink screen. The screen can be edited only by users with network role permissions, but it is viewable by all authorized users. The following table describes the fields within the Edit Shared Uplink Set screen.
Field name Description PID PID status icon (on or off) for the port Speed/Duplex Pull-down menu to specify the speed and duplex (where applicable) of the uplink port. Half-duplex operations are not supported by the VC-Enet module. For shared uplink sets using an associated FCoE network, the Speed/Duplex is always Auto. Action Perform delete operations Associated FCoE Network (VLAN tagged) Allows addition of FCoE network. See "Defining an FCoE network (on page 129).
Task Action Add a single associated network Click Add above the table, or right-click on the header row to display a menu, and then select Add. Select the a single Associated Network radio button. For more information, see "Defining a shared uplink set (on page 127)." Add multiple associated networks Click Add above the table, or right-click on the header row to display a menu, and then select Add.
Field Description Shared Uplink Set Displays the status, UID, and name of the shared uplink set Has FCoE Indicates whether the shared uplink set contains an FCoE network Port Status Shows the link status, link speed, and connectivity of the port. If the port is unlinked and no connectivity exists, the cause is displayed. For more information about possible causes, see "Port status conditions (on page 264).
This screen allows you to create a copy of a shared uplink set. This can facilitate the setup of an Active/Active shared uplink set configuration. All of the associated networks and their properties are duplicated during the copy. A new name for the shared uplink set must be selected and all networks must be renamed using a common renaming scheme. To copy a shared uplink set: 1. Enter a name for the new shared uplink set in the Shared Uplink Set Name field. 2.
o The replacement string can be empty. o The new associated network names cannot be duplicates of existing network names, and the names must follow the normal network name rules. o You cannot edit the associated network names individually on this screen. After the associated networks are created, you can rename the networks as normal.
This summary screen displays the mapping of networks to external shared uplink connections. This screen is only applicable if multiple networks identified by VLAN tags are being connected over a single external uplink set. The following table describes the fields within the Shared Uplink Sets (Associated Networks) screen.
Virtual Connect fabrics Understanding FC fabrics Beginning with Virtual Connect 3.70, there are two supported VC SAN fabric types, FabricAttach fabrics and DirectAttach fabrics. A FabricAttach fabric uses the traditional method of connecting VC-FC and VC FlexFabric modules, which requires an upstream NPIV-enabled SAN switch.
• By default, all of the FlexFabric FC-capable uplinks are configured as Ethernet until they are configured as part of the VC SAN fabric. After the FC-capable uplinks are configured as part of the VC SAN fabric, the FC SFP transceivers connected to those uplinks become enabled and allow connectivity to the data center SAN fabric.
• The VC-FC and FlexFabric modules use dynamic login distribution to equally distribute server logins across all available uplink ports. The port with the least number of active logins is used for server connectivity. When the number of logins is equal, VC-FC or FlexFabric modules utilize a round-robin technique.
• The VC-FC and FlexFabric modules use dynamic login distribution to provide an uplink port failover path that enables server connections to fail over within the VC SAN fabric. If a VC SAN fabric uplink port becomes unavailable, servers logged in through that uplink are automatically reconnected using one of the remaining uplinks in the VC SAN fabric, resulting in automatic failover.
contrast to the FabricAttach server port information status, which shows the server port logged in through the uplink port. When creating DirectAttach VC SAN fabrics, consider the following: • The DirectAttach fabric is only supported with the HP VC FlexFabric 10Gb/24-port Module when it is connected to one or more supported HP 3PAR storage systems. o The minimum required version of HP Virtual Connect firmware is v3.70.
• When creating the DirectAttach fabric, all participating uplinks can be connected to the same 3PAR storage system in order to form a VC SAN fabric correctly. When a DirectAttach VC SAN fabric is using multiple uplink ports, features of login balancing and login re-distribution are not applicable. These features apply only on the uplinks within a FabricAttach VC SAN fabric.
• For more control over the uplink port utilization, you can create several DirectAttach VC SAN fabrics connected to the same 3PAR storage system. This configuration can assist the distribution of servers according to server I/O needs and workloads.
• You can attach up to four HP 3PAR storage systems directly to the VC FlexFabric module using a single VC SAN fabric. This limitation is due to the number of FC-capable uplink ports available on the FlexFabric module. Mixed FabricAttach and DirectAttach VC SAN fabrics Mixing FabricAttach and DirectAttach VC SAN fabrics is fully supported in the same Virtual Connect domain.
To mix FabricAttach and DirectAttach fabrics, you must create two different VC SAN fabrics because a VC SAN fabric can only contain uplink ports of one type. Bay groups In a multi-enclosure environment, all enclosures must have the same VC-FC and FlexFabric module configuration. For example, if the local enclosure has VC-FC modules in bays 3 and 4, each remote enclosure must also have VC-FC modules in bays 3 and 4. This is called an FC bay group.
To perform a server profile migration of a SAN-booted server between enclosures directly attached to a 3PAR storage system in the VC multi-enclosure environment, you must perform the following steps manually: 1. Power off the server. 2. Un-assign the server profile. 3. Change the Primary and Secondary Target WWNs in the FC Boot Parameters section of the profile to reflect the WWNs of the 3PAR storage array ports directly connected to the destination enclosure.
Define SAN Fabric screen To define a SAN fabric, select the Define SAN Fabric link on the home page, click Define SAN Fabric on the SAN Fabrics (Server Connections) screen (on page 158), click Add on the SAN Fabrics (External Connections) screen (on page 156), or select SAN Fabric from the Define pull-down menu. In FabricAttach mode, only connect HP VC 4Gb FC module, HP VC 8Gb 24-Port FC module, HP VC 8Gb 20-Port FC module, or FlexFabric FC uplinks to Fibre Channel switch ports that are NPIV-enabled.
• Multi-enclosure domain The following table describes the columns and fields within the Define SAN Fabric screen. Column Description Fabric Name Descriptive name for the virtual fabric. Do not use spaces. Fabric Type The type of fabric. This option is available after a FlexFabric module port is added. Supported fabric types are FabricAttach and DirectAttach. The default type is FabricAttach. Select FabricAttach if the FlexFabric module is connected using traditional SAN switches.
The following table describes the available actions in the Define SAN Fabric screen. Clicking another link in the pull-down menu or left navigation tree causes the current edits that have not been applied to be lost. Task Description Create a fabric name Type a name in the Fabric Name field. Do not use spaces. Add an uplink port Select a bay and port from the Add Port cascading menu. In double-dense mode, do not select Bay 7 or Bay 8.
The automatic option is only available on FlexFabric modules in a FabricAttach fabric and enables you to specify an interval, in seconds, for the length of time the previously offline links must be stable before the module can re-distribute logins. Login re-distribution is not supported for DirectAttach fabrics. FCoE Connection Speed To change these settings, click the selection box, and then select a setting (100Mb to 8Gb): • Set a custom value for the Preferred FCoE Connection Speed.
To see how logins are currently distributed on the VC-FC module, navigate to the Interconnect Bays Status and Summary screen (on page 231) and select the desired VC-FC module. A new Uplink Port column is added to the Server Ports section of the screen.
To see how logins are currently distributed on the VC FlexFabric module, navigate to the Interconnect Bays Status and Summary screen (on page 231) and select the desired VC FlexFabric module. A new SAN Uplink Port column is added to the Server Ports tab. You can also see how logins are currently distributed on the VC-FC or FlexFabric modules by logging in to the upstream FC SAN fabric switch.
Use this screen to edit a SAN fabric configuration. The following table describes the fields within the Edit SAN Fabric screen. Field Description Fabric Fabric Name Descriptive name for the fabric. Do not use spaces. Status Status of the fabric Fabric Type The type of fabric, FabricAttach or DirectAttach. After a fabric is defined, its type cannot be changed. Login Re-distribution Login Re-distribution setting for the fabric. For all standard VC-FC modules, this is always Manual.
Task Description Modify a fabric name Type a name in the Fabric Name field. Do not use spaces. Set the uplink port speed Click the pull-down arrow in the Configured Speed field, and then select a speed. The default value is Auto, which auto-negotiates the speed with the FC switch to which the ports are connected. If 8Gb is chosen for the uplink speed on an FC module that does not support 8Gb, the value is automatically translated to "Auto" within VCM.
This screen lists all of the SAN fabrics that have been created and displays the external connection information. The following table describes the fields within the SAN Fabrics (External Connections) screen. Field Description Status Status of the fabric SAN Fabric Name of the fabric Fabric Type The type of fabric, FabricAttach or DirectAttach Login Re-Distribution Login Re-distribution setting for the fabric. For all standard VC-FC modules, this is always Manual.
Task Action Delete a SAN fabric Click the Delete link in the Action column, or left-click to select a fabric, right-click to display a menu, and then select Delete. Re-distribute logins Click the ReDistribute link in the Action column, or left-click to select a fabric, right-click to display a menu, and then select Redistribute Logins. SAN Fabrics (Server Connections) screen To access this screen, click SAN Fabrics in the left navigation tree, and then click the Server Connections tab.
Task Action Delete a SAN fabric Select the checkboxes for the fabrics you want to delete, and then click Delete. Re-distribute logins on a SAN fabric Select the checkboxes for the fabrics, and then click Redistribute Logins. Edit a SAN fabric Click on a SAN fabric name. Edit a profile Click on a profile link. Fibre Channel Settings (Misc.) screen Automatic Login Redistribution is an advanced option that can be enabled for a Virtual Connect fabric that is located on a FlexFabric module.
Virtual Connect server profiles Understanding server profiles The I/O connection profile, or server profile, provides a link between the server and the networks and fabrics defined in VC. The server profile can include MAC and WWN addresses, as well as boot parameters for the various connection protocols supported by VC. After being defined, the server profile can be assigned to any server blade within the Virtual Connect domain. VCM supports up to 256 profiles within the domain.
• Before creating the first server profile: o Select whether to use assigned serial numbers or factory default serial numbers. o Select whether to use movable, administered MAC addresses and WWNs, or the local server blade factory default MAC addresses and WWNs. • After an enclosure is imported into a Virtual Connect domain, server blades are isolated from the networks and SAN fabrics until a server profile is created and assigned.
and SAN boot settings and connects the appropriate networks and fabrics. Server blades that have been assigned a profile and remain in the same device bay do not require further Virtual Connect Manager configuration during a server or enclosure power cycle. They boot and gain access to the network and fabric when the server and interconnect modules are ready.
For more information, see "iSCSI and FCoE port assignments (on page 169)" and "Creating FCoE HBA connections for a BL890c i4 (on page 186)." • FC profile connection entries are mapped to blades such that all of the FC HBAs on the first blade are mapped first, then the HBAs on the second blade, and so on. When a profile is first created, it will have enough FC profile connections for the HBAs on one blade. The maximum number of FC connections allowed is 4 times the original number of entries.
The total actual shareable bandwidth cannot exceed 10Gb; however, the preferred speed and maximum bandwidth settings can exceed a total of 10Gb, allowing ports to take advantage of unused bandwidth when available. A Flex-10 capable NIC (embedded Ethernet or mezzanine card) is seen as eight FlexNICs per 10Gb port if that NIC is directly connected to an HP Virtual Connect Flex-10 or FlexFabric module.
3. Auto. Choosing "Auto" evenly distributes the available bandwidth between all connections assigned to "auto". 4. Disabled. VC determines the bandwidth speed. For more information, see "Bandwidth assignment (on page 171)." Although the Port Speed Setting is available for all network connections in a profile, Virtual Connect can only control link speed for Flex-10 NICs when they are connected to an HP Virtual Connect Flex-10 Module. Virtual Connect cannot control the link speed of traditional NICs.
FlexFabric module uplink ports X1-X4 can be configured as FC fabric ports or Ethernet network ports. If a port is configured as an FC fabric port, the protocol used is FCoE, and the server profile connection to that fabric is an FCoE connection. Because of the many possible configurations of the FlexFabric module, pluggable modules can differ for each uplink port on the FlexFabric module. If the uplink port is being used for an FC fabric, an SFP-FC connector is required.
• Disable—VC Manager sends a configuration update to the associated mezzanine NIC or embedded NIC to disable PXE operations. • Use BIOS—Current BIOS settings are used for embedded NICs and mezzanine NIC PXE operations. VC Manager makes no changes to the current settings. This is not applicable to Flex-10 LOM ports when used with Flex-10 interconnect modules.
In each configuration above, only one embedded NIC port can have PXE enabled (any embedded NIC port is eligible), but any and all mezzanine NIC ports can be enabled whether or not an embedded NIC port is being enabled. For more information on RBSU, see the HP ROM-Based Setup Utility User Guide on the Documentation CD or the HP website (http://www.hp.com/support/smartstart/documentation).
It is not possible to enable both SAN boot (FC or FCoE) and iSCSI boot in a server profile at the same time. The priority is given to the first connection that is enabled, which might be FC/FCoE or iSCSI. Be sure that your Ethernet adapter, operating system, and device drivers support iSCSI boot. An iSCSI connection cannot be assigned to multiple networks. The following steps provide an overview of the procedure to enable iSCSI boot: 1. Create iSCSI connections on the Profile page. 2.
• MZ1:1-c • MZ1:1-d Observe the following configuration guidelines: • The corresponding physical functions for each port on the same adapter must have the same personality. For example, if MZ1:1-b is iSCSI, MZ1:2-b must also be iSCSI; it cannot be Ethernet. • PXE and iSCSI can be enabled at the same time on a single port (PXE on a, iSCSI on b). • PXE and FCoE can be enabled at the same time on a single port (PXE on a, FCoE on b).
The third example is similar to the second except that the LOM is the NC551i. The example compares ten Ethernet, one iSCSI, and four FCoE connections. The second PF on MEZZ2:Port 2 has to be enumerated as iSCSI since the corresponding PF on port 1 is iSCSI. But, since there is only one iSCSI connection defined in the Profile, the second PF on MEZZ2:Port 2 is disabled.
Requested Allocated FlexNIC b Auto 3Gb FlexNIC c Auto 3Gb FlexNIC d Auto 3Gb In cases where the requested bandwidth settings you specified for the four FlexNICs in a single physical port exceed 10Gb, the following rules are applied in this order: 1. If FlexNICs with a "preferred" or "custom" value for requested bandwidth exceed 10Gb, each FlexNIC is allocated bandwidth proportional to its requested bandwidth setting.
o • Select WWN ranges for server profiles Serial Number Settings screen (on page 176) o Add a serial number and UUID to server profiles Ethernet Settings (MAC Addresses) screen To access this screen, click the expand the Ethernet link in the left navigation tree and select MAC Addresses, click Network Settings in the Network section of the home page, or select Ethernet Network Settings from the Configure menu at the top of the screen.
For more information, see "MAC address settings (on page 174)." MAC address settings IMPORTANT: Configuring Virtual Connect to assign server blade MAC addresses requires careful planning to ensure that the configured range of MAC addresses is used once within the environment. Duplicate MAC addresses on an Ethernet network can result in a server network outage. Each server blade Ethernet NIC ships with a factory default MAC address.
• If a server blade is removed from a bay within a Virtual Connect domain and installed in another bay in the same Virtual Connect domain or in a bay in a different domain, it is assigned the new set of addresses appropriate for that server location. • When FlexFabric adapters are in use, Virtual Connect assigns a MAC address to each FCoE connection in the server profile. Fibre Channel Settings (WWN Settings) screen Use this screen to select World Wide Name ranges for server profiles.
• Select Fibre Channel Settings from the Configure pull-down menu. Serial Number Settings screen The serial number settings feature enables you to add a serial number and UUID to server profiles. The UUIDs that Virtual Connect assigns are randomly generated. A UUID pool is not required. By configuring VCM to assign serial numbers, a profile can present a single serial number regardless of the physical server.
Advanced Profile Settings MAC addresses for the domain are provided by Virtual Connect. You can override this setting and use the MAC addresses that were assigned to the hardware during manufacture by selecting the Use Server Factory Defaults for Ethernet MAC addresses checkbox. This action applies to every Ethernet connection in the profile. For additional information, see "MAC Address Settings (on page 174)." WWNs for the domain are provided by Virtual Connect.
the Virtual Connect user interface. The assigned node WWN is always the same as the port WWN incremented by one. Virtual Connect assigns or migrates WWNs for server FC ports connected to HP Virtual Connect modules. Virtual Connect also assigns WWNs to FC ports that are not connected to an I/O module because Virtual Connect modules can be added later. Server FC ports connected to non-Virtual Connect modules retain the server factory default WWNs.
NOTE: The process to assign, modify, or unassign a profile to an Integrity BL8x0c i2 server blade or Integrity BL8x0c i4 server blade can take up to several minutes. The following table describes the fields within the Define Server Profile screen.
Column name Description Profile Profile Name Descriptive name for the server profile. The text can be up to 64 alpha-numeric characters, dashes, and underscores. Do not use spaces. Network Access Group Associates a network access group to the profile. The default network access group is "default." Advanced Profile Settings (on page 177) Select to show if server factory defaults are being used for Ethernet MAC Addresses, Fibre Channel WWNs, and Serial Numbers.
Column name Description configured speed for the network in 100-Mb increments.* For all speed types the maximum port speed is determined by the maximum configured speed for the network. If the speed type is "Auto," VCM determines the appropriate port speed based on the available bandwidth for the port. The configured port speed behaves like Auto (default). If the speed type is "Disabled," bandwidth is not allocated. You can only set the minimum port speed here. The maximum is set in the port link speed.
Column name Description network. Auto—VCM determines the appropriate port speed based on the available bandwidth for the port. Preferred—Use the preferred speed of the SAN Fabric or FCoE network selected for this connection. If no preferred speed is configured, VCM determines the speed. Custom—Allows you to select a custom port speed setting between 100Mb and the configured maximum connection speed in 100Mb increments. Disabled—The FCoE connection is disabled and no bandwidth is allocated.
Task Action Enable or disable PXE, or Use BIOS 1 2 Select to use a multicast filter or filter set Click the pull-down arrow in the Multicast Filter column, and then select a multicast filter or filter set. Delete an Ethernet connection Click the Delete link in the Action column, or click the connection to select it, right-click to display a menu, and then click Delete. The first two connections cannot be deleted.
To define a server profile: 1. Enter the server profile name. The server profile name can be up to 64 characters in length (no spaces). Because the server profile can be assigned to different locations, HP recommends that the name reflect the server function. The profile can be renamed at any time. 2. To use server factory defaults for Ethernet MAC addresses, Fibre Channel WWNs, or serial numbers, select the Advanced Profile Settings checkbox.
After selecting an item from the pull-down menu in the SAN Boot Setting column, you must click outside the grid to complete the selection. This is the same procedure that is followed when selecting a fabric or network for an FC or Ethernet connection, respectively. After the Boot Setting column has been completed, you can edit the Target Port Name and LUN. 8. Set up FCoE HBA connections: o Click on the down arrow under FC SAN/FCoE Network Name to select an available SAN or FCoE network.
Creating FCoE HBA connections for a BL890c i4 Additional steps are necessary when a BL890c i4 is installed, and the enclosure has FCoE modules in bays 1 and 2. The figure below shows the first four connections created by default, plus four additional connections that were added manually. The FCoE entries for I/O bays 1 and 2 (highlighted below) get mapped to LOMs 1 and 2 on blades 1 and 2.
All profiles created prior to the upgrade will remain unchanged and continue to operate similar to pre-4.01 behavior. Example: A configuration with HP VC Flex-10/10D modules in I/O Bays 1 and 2 and HP VC FlexFabric modules in I/O Bays 3 and 4 in a pre-4.01 environment would only allow mapping of FCoE connections to the VC FlexFabric modules in I/O Bays 3 and 4. A server profile in this environment would have the following mapping for the Ethernet and FCoE connections.
Ethernet profile connection Map to bay Map to server port 11 3 Mezz1:1D 12 4 Mezz1:2D 13 1 Not mapped 14 2 Not mapped FCoE connections for new profiles have changed to the connections shown in the following table. FCoE profile connection Map to bay Map to server port 1 1 LOM1:1B (FCoE network only) 2 2 LOM1:2B (FCoE network only) 3 3 Mezz1:1B (either FCoE network or SAN Fabric) 4 4 Mezz1:2B (either FCoE network or SAN Fabric) After upgrading from versions previous to VC v4.
Flex-10 iSCSI connections Use this screen to set the Flex-10 iSCSI connections.
Item Description Initiator Name Name used for the iSCSI initiator on the booting system. This name is the IQN name for the host that is created by the storage administrator. The initiator name length can be a maximum of 223 characters. Target Name Name of the target from which to boot. This is the IQN name for the storage device that is provided by the storage administrator during the LUN setup. The target name length can be a maximum of 223 characters.
To use DHCP when configuring the iSCSI boot configuration, select the Use DHCP to retrieve iSCSI parameters checkbox. Selecting this option requires a DHCP server to be set up with iSCSI extensions to provide boot parameters to servers. The DHCP Vendor ID is offered by the initiator to the DHCP server to retrieve the iSCSI boot configured data. For more information, see the documentation that ships with the DHCP server and "DHCP option 43 (on page 193).
To use DHCP when configuring the iSCSI Initiator Network configuration, select the Use DHCP to retrieve network configuration checkbox. This enables the iSCSI option ROM to retrieve the TCP/IP parameters from the DHCP server. iSCSI Boot Assistant The iSCSI Boot Assistant retrieves the iSCSI boot and authentication data for HP LeftHand P4000 series devices, and then automatically populates most fields on the Flex-10 iSCSI Connections screen ("Flex-10 iSCSI connections" on page 189).
To use the iSCSI Boot Assistant: 1. Launch the iSCSI Boot Assistant by clicking Use Boot Assistant on the Flex-10 iSCSI Connections screen ("Flex-10 iSCSI connections" on page 189). The Boot Volume Information screen appears. 2. Select the appropriate storage management target from the Management Targets pull-down menu. 3. Click Retrieve to populate the available selections in the Boot Volume pull-down menu, and then select a volume. CAUTION: Care should be taken when selecting the volume.
• —Replace this parameter with a valid IPv4 address in dotted decimal notation. This is a mandatory field. • —Replace this parameter with a decimal number ranging from 1 to 65535 (inclusive). This is an optional field. The default TCP port 3260 is assumed, if not specified. • —This parameter is a hexadecimal representation of the Logical Unit Number of the boot device. This is an optional field. If not provided, LUN 0 is assumed to be the boot LUN.
• Default TCP Port and Mutual CHAP: iscsi:”192.168.0.2”::”000000000000000E”:”iqn.2009-4.com:1234567890”::”E” :”D”:”M” o Target IP address: 192.168.0.2 o Target TCP port: Use default from RFC 3720 (3260) o Target boot LUN: 0x0E o Target iqn name: iqn.2009-04.com:1234567890 o Initiator name: Not specified. Use the Initiator name already configured. Use the default name if none was configured.
is selected, a separate window is displayed to enable the defining and editing of virtual networks and VLAN ID mappings. A window appears and displays additional options.
Defining server VLAN mappings Forced VLAN Mappings If the 'Force same VLAN mappings as Shared Uplink Sets' option is selected, server VLAN mappings are the same as the shared uplink set VLAN mappings. You can choose only from a list of shared uplink sets when selecting Multiple Networks. After selecting a shared uplink set from the pull-down list, a list of VLANs that belong to the chosen shared uplink set is displayed.
If the selected network is part of a shared uplink set, it has an associated external VLAN mapping. This external VLAN is used to pre-populate the server-assigned VLAN entry to maintain consistency throughout the VC domain. However, multiple networks on different shared uplink sets can have the same external VLAN mapping. If those networks are selected for the same server port, you must edit the server VLAN to ensure all VLANs are unique for each server port.
• With Legacy VLAN capacity, each server connection is limited to 28 VLAN mappings. • With Expanded VLAN capacity, each server connection is limited to 162 VLAN mappings. However, each physical server port is also limited to 162 VLAN mappings. IMPORTANT: Care must be taken not to exceed the limit per physical server port.
Server Profiles screen This screen lists all server profiles that have been defined within the domain, including assigned and unassigned profiles. From this screen, you can see the assigned device bays, NIC MAC addresses, FC HBA WWNs, network connections, and Fibre Channel Fabric and Boot Parameters for all server profiles, as well as generate a printable report of this information.
Task Action Show all profiles, only assigned profiles, or only unassigned profiles Click the down arrow in the Show: box. Define a new profile Left-click in the table, right-click to display a menu, and then click Add; or select Server Profile from the Define menu at the top of the screen; or click Add at the bottom of the screen. Edit a server profile Left-click on the profile row, right-click to display a menu, and then click Edit; or click the Edit link in the Action column.
• Assign, unassign, or re-assign the profile to a device bay • Copy the profile • Delete the profile • Modify FCoE HBA connections • Set FC boot parameters NOTE: The process to assign, modify, or unassign a profile to an Integrity BL8x0c i2 server blade can take up to several minutes. If VC-assigned MAC addresses, WWNs, or non-default Fibre Channel boot parameters are being used, the server blade must be powered off before any server side changes can be made.
The screen can be edited only by users with server role permissions, but it is viewable by all authorized users. The following table describes the fields within the Edit Server Profile screen. Column name Description Profile Profile Name Descriptive name for the server profile. Do not use spaces.
Column name Description on the Serial Number Settings screen (on page 176) Server UID The server UUID generated by Virtual Connect and assigned to this profile Ethernet Adapter Connections Port Relative order of the Ethernet port on the server receiving the profile. System board NICs are first in the order, followed by NICs on mezzanine cards. See "iSCSI and FCoE port assignments (on page 169)" and "Bandwidth assignment (on page 171).
Column name Description "Auto", "Preferred", "Custom", and "Disabled". The default value is "Preferred". Auto—The maximum port speed is determined by the maximum configured speed for the network. Preferred—The speed of the network is the same as the preferred speed of the network to which the connection is associated. If no preferred speed is configured for a network, it behaves like "Auto". Custom—You can configure any speed from 100Mb to the maximum configured speed for the network in 100-Mb increments.
Column name Description WWPN As of VC 3.70, the actual hardware WWN for mapped connections appears. For unmapped connections, FACTORY-DEFAULT continues to appear. If the profile is assigned, the WWN assigned to the port appears. If the profile is unassigned and the domain is set to show factory default WWNs, FACTORY-DEFAULT appears. If the profile is using VC-defined WWNs, the VC-defined WWN appears. If the profile is using hardware WWNs, FACTORY-DEFAULT appears.
Column name Description Mapping Server hardware mapping assignment. See "iSCSI and FCoE port assignments (on page 169)." Action Delete a connection. Connections can be removed starting with the last connection in the list. * Only Flex-10 NICs and FlexFabric NICs connected to Flex-10 modules and FlexFabric modules are able to set the transmit bandwidth allocation. Other parts are restricted to the actual physical speed (1Gb).
Task Action Change the SAN fabric connection Click the pull-down arrow in the FC SAN name box. Change or disable the port speed Click the pull-down arrow in the Port Speed box. Select the Fibre Channel Boot Parameters checkbox. View Fibre Channel Boot Parameters Enable Fibre Channel Boot on a port Select the Fibre Channel Boot Parameters checkbox. Click the pull-down arrow in the SAN Boot box, and then select the boot order. Enter a valid Boot Target name and LUN in the edit boxes.
b. Hover your mouse over each server blade in the Front View of the enclosure to find the HP ProLiant BL680c G7 Server Blade, and then click the server blade. The Server Bay Status screen appears. You can also view this screen by clicking the HP ProLiant BL680c G7 Server Blade device bay from the Device Bays link in the Hardware section in the left navigation tree. c. 2. Be sure that the Power Status/Control status value is Off. If the status is On, click Momentary Press to power down the server blade.
b. Right-click the heading row on the External Connections tab on the SAN Fabrics screen, and then select Add, or click the Add button. The Define SAN Fabric screen appears. c. Enter a Fabric Name, and then select an available port of an available bay for the SAN fabric from the Add Port pull-down list. Select one or more uplink ports for an HP VC FlexFabric 10Gb/24-port Module. d. Click Apply to save the changes.
e. Be sure that the SAN fabric appears on the SAN Fabrics screen with the appropriate bay and ports assigned. 3. Add a server profile for the HP ProLiant BL680c G7 Server Blade. a. Click Server Profiles in the left navigation tree or select Server Profile from the Define menu at the top of the screen. b. Right-click the Server Profiles list on the Server Profiles screen, and then select Add, or click the Add button. The Define Server Profile screen appears. c. Enter a Profile Name.
d. If necessary, click Unassigned in the Ethernet Adapter Connections section, and then select an available network from the pull-down list. e. In the FCoE HBA Connections section, click the Unassigned FC SAN Name for the bay you used when you created the SAN fabric in step 2, and then select the SAN fabric you created from the pull-down list.
f. In the Assign Profile to Server Bay section, select the bay for the HP ProLiant BL680c G7 Server Blade to which you want to assign the server profile from the Unassigned Server pull-down list. g. Click Apply to save changes and stay on this screen, or click Apply & Close to save changes and to go the Server Profiles summary screen. h. On the Server Profiles screen, be sure that the server profile with FCoE connections has been properly assigned. 4.
b. Click Momentary Press to power up the server blade. c. 5. Be sure that the Power Status/Control indicator turns green and the status value is On. Verify the HP ProLiant BL680c G7 Server Blade FCoE connections: a. On the Server Bay Status screen for the HP ProLiant BL680c G7 Server Blade, scroll down to the correct port in the Server Ethernet Adapter Information section to view the FCoE information. b. Be sure that the SAN fabric and bay information is correct for the server.
Unassigning a server profile with FCoE connections to an HP ProLiant BL680c G7 Server Blade and deleting the SAN fabric To unassign a server profile with FCoE connections from an HP ProLiant BL680c G7 Server Blade and delete the SAN fabric: 1. Be sure that the HP ProLiant BL680c G7 Server Blade is powered down: a. Click the HP ProLiant BL680c G7 Server Blade device bay in the Device Bays link in the Hardware section in the left navigation tree. The Server Bay Status screen appears. b.
c. Click Apply to save changes and remain on the Edit Server Profile screen, or Apply & Close to save changes and go to the Server Profiles screen. d. On the Server Profiles screen, be sure that the Server Bay Assignment for the server profile with FCoE connections is Unassigned.
e. Right-click the server profile with FCoE connections, and then select Delete. f. 3. In the Confirmation dialog box, enter the name of the server profile, and then click OK. Delete the SAN fabric: a. Click SAN Fabrics in the left navigation tree. The SAN Fabrics screen appears.
b. On the External Connections tab, right-click the SAN fabric you want to delete, and then select Delete. c. In the Confirmation dialog box, enter the name of the SAN fabric, and then click OK.
d. Click the HP ProLiant BL680c G7 Server Blade device bay in the Hardware Overview section in the left navigation tree. The Server Bay Status screen appears. Be sure that the Power Status/Control status value is Off. e. Scroll down to the Server Ethernet Adapter Information section and be sure that no assigned SAN fabric appears in the Network column for the HP ProLiant BL680c G7 Server Blade.
• When a profile is added, the FC/FCoE connections initially displayed are based on the FC/FCoE module configuration in the domain. A pair of horizontally adjacent FC/FCoE-capable modules has two connections. • Connections can only be added or removed from the bottom. You can only add or delete connections at the end of the list. • You can remove connections at any time (one at a time, from the bottom).
4 Start with modules in Bays 3 and 4, create a profile (add 2 connections), install modules into Bays 5 and 6, then edit the profile. Port 1 2 3 4 Connected to — Bay 3 Bay 3 Bay 4 Bay 5 Bay 3 — Bay 4 — Bay 4 Bay 6 — Add connection is disallowed because the current FC module configurations do not match the existing connections in the profile. This profile is not useful after the hot-plug install. To resolve this issue, delete connections 3 and 4, save the profile, and then scenario 3 applies.
9 Start with FCoE-capable modules in Bays 1 and 2, then create a profile and add connections. Port 1 2 Connected to Bay 1 Bay 1 — Bay 2 — — Bay 2 — — — Port Connected to 1 Bay 1 2 Bay 2 3 Bay 1 4 Bay 2 5 Bay 1 6 Bay 2 7 Bay 1 8 Bay 2 Add connection, 6 times* 10 Port Start with 8 FCoE-capable 1 modules, then create a profile and add connections.
IMPORTANT: If you plan to use Insight Control Server Deployment for RedHat Linux installation and also plan to use User- or HP-defined MAC addresses, you must import the enclosure and assign profiles before running Insight Control Server Deployment. "Rip and replace" is not supported in a Virtual Connect environment. For more information on HP Insight Control Server Deployment, see the HP website (http://www.hp.com/servers/rdp).
Virtual Connect modules Firmware updates To update firmware, use the HP BladeSystem c-Class Virtual Connect Support Utility v1.8.0. For more information on updating the firmware, see the HP BladeSystem c-Class Virtual Connect Support Utility documentation on the Installing tab of the HP BladeSystem Technical Resources website (http://www.hp.com/go/bladesystem/documentation).
• The VCM configuration, module types, and cabling configuration must be the same before and after the upgrade. • The VCM credentials must be the same before and after the upgrade. • Do not perform a downgrade if servers are powered on or if a server profile migration operation has been performed since the upgrade. Performing a downgrade under these conditions can result in duplicate MACs/WWNs in the domain.
• o OK indicates that all modules are connected. o Failed indicates that one or more modules are not connected properly. Check the cable connections. Redundancy Status indicates whether all VC-Enet modules would remain fully interconnected if a module or external cable was removed or failed. Horizontally-adjacent modules are considered to have OK redundancy status because of the reliability of their internal link. o OK indicates that redundant/reliable connections exist.
The collection of Throughput Statistics can be enabled or disabled, and the sample rate can be configured. The sampling rate determines the total sampling time frame. The available sampling rates go from 1 to 5 minutes or 1 hour, collecting up to 12.5 days of samples, depending on the sampling rate. For detailed information about Throughput Statistics settings, see "Configuring Throughput Statistics (on page 100).
Task Action Refresh data in the chart Click Refresh at the button of the chart. The Refresh option will be disabled according to the sampling rate. It becomes enabled after the time frame established by the sampling rate has elapsed. Zoom selected chart range To draw a zoom area, click on the chart and drag the mouse until all the data points of interest are highlighted. A new chart is generated focusing on the points selected after releasing the mouse button.
Row Description Interconnected Trays Number of interconnect trays in the enclosure Removing an enclosure To remove a remote enclosure from the domain: 1. Disassociate all profiles, networks, port sets, and port monitors from the enclosure. If the enclosure is currently in a No-COMM state, the remote enclosure remains in VC mode. The No-COMM condition must be repaired prior to the enclosure removal. 2.
Enclosure Status screen When a VC domain loses connectivity with a remote enclosure Onboard Administrator, the Enter OA Credential button appears on this screen. For more information, see "Recovering remote enclosures (on page 273)." The following table describes the rows within the Enclosure Status screen.
Interconnect Bays Status and Summary screen The following table describes the rows within the Interconnect Bays Status table in the Interconnect Bays Status and Summary screen.
Causes for INCOMPATIBLE status When an interconnect module status is INCOMPATIBLE, details can be viewed in the System log ("System Log (System Log) screen" on page 47). The system log provides information about why an interconnect module is marked incompatible so that proper corrective action can be taken.
• FC modules in multi-enclosure double dense domains When using VC-FC modules, multi-enclosure double dense domains require similar and compatible VC-FC modules in bays 5, 6, 7, and 8 in all enclosures. If a multi-enclosure double dense configuration contains incompatible VC-FC modules in bays 5, 6, 7, or 8 in either the local or remote enclosures, some or all of the compatible VC-FC modules in the remote enclosures might be designated INCOMPATIBLE after import. Corrective action: a.
Row Description Memory Module Usage Displays the current memory usage of the module in kilobytes. Under normal operating conditions, memory utilization generally remains below the threshold value of 90% (red line). Power Status/Control Power state of the device The following table describes the rows within the Interconnect Bay Information table.
Column Description Label Uplink port number Network(s) Network name or the name of the shared uplink associated with this port Status Shows the link status, link speed, and connectivity of the port. If the port is unlinked and no connectivity exists, the cause is displayed. For more information about possible causes, see "Port status conditions (on page 264).
Ethernet Bay Summary (Server Port Information) screen This screen provides a summary of the server port information. To remove a module, see "Interconnect module removal and replacement (on page 265)." The following table describes the columns within the Server Port Information table.
Ethernet Bay Summary (MAC Address Table) screen This screen shows the MAC addresses that have been seen on the ports of the VC-Enet module. If a network is assigned to the port, the network name appears. If a shared network is assigned to the port, the network name and VLAN ID appear. If a LAG has formed with the uplink ports, the LAG ID appears. The following table describes the columns within the MAC Address Table.
Ethernet Bay Summary (IGMP Multicast Groups) screen This screen shows the IGMP multicast groups that are active on ports of this VC-Enet module. The multicast group IP address, the port, and its MAC address are shown in the table. The following table describes the columns within the IGMP Multicast Groups table.
Ethernet Bay Summary (Name Server) screen This screen contains a list of entries in the name server table for the VC FlexFabric module. The following table describes the columns within the Name Server table.
To refresh the statistics, click Refresh Statistics. The following tables describe the rows within the Ethernet Port Detailed Statistics screen.
DCBX Information* Description Overall Status The overall status of DCBX protocol exchange with peer entity. The status value “Ok” indicates that no error is detected in DCBX operation, for example the protocol exchange is successfully completed or the port is not enabled for DCBX. The status value “Failed” indicates an error in one of the DCBX feature information exchanges. The specific error reason displays in the individual feature state field below.
Port Statistic Description IpInHdrErrors The number of input datagrams discarded due to errors in their IP headers, including bad checksums, version number mismatch, other format errors, time-to-live exceeded, and errors discovered in processing their IP options IpForwDatagrams The number of input datagrams for which this entity was not their final IP destination. As a result, an attempt was made to find a route to forward them to that final destination.
Port Statistic Description EtherStatsPkts65to127Octets The total number of packets (including bad packets) received that were between 65 and 127 octets in length inclusive (excluding framing bits, but including FCS octets) EtherStatsPkts128to255Octets The total number of packets (including bad packets) received that were between 128 and 255 octets in length inclusive (excluding framing bits, but including FCS octets) EtherStatsPkts256to511Octets The total number of packets (including bad packets) rec
Port Statistic Description EtherStatsCollisions The best estimate of the total number of collisions on this Ethernet segment. The value returned depends on the location of the RMON probe. Section 8.2.1.3 (10BASE-5) and section 10.3.1.3 (10BASE-2) of IEEE standard 802.3 states that a station must detect a collision, in the receive mode, if three or more stations are transmitting simultaneously. A repeater port must detect a collision when two or more stations are transmitting simultaneously.
Port Statistic Description Dot3StatsMultipleCollisionFrames A count of successfully transmitted frames on a particular interface for which transmission is inhibited by more than one collision. A frame that is counted by an instance of this object is also counted by the corresponding instance of either the ifOutUcastPkts, ifOutMulticastPkts, or ifOutBroadcastPkts, and is not counted by the corresponding instance of the dot3StatsSingleCollisionFrames object.
Port Statistic Description Dot3StatsInternalMacReceiveErrors A count of frames for which reception on a particular interface fails due to an internal MAC sublayer receive error. A frame is only counted by an instance of this object if it is not counted by the corresponding instance of either the dot3StatsFrameTooLongs object, the dot3StatsAlignmentErrors object, or the dot3StatsFCSErrors object. The precise meaning of the count represented by an instance of this object is implementation-specific.
Port Statistic Description IfHCOutMulticastPkts The total number of packets that higher-level protocols requested be transmitted, and which were addressed to a multicast address at this sublayer, including those that were discarded or not sent. For a MAC layer protocol, this includes both Group and Functional addresses. This object is a 64-bit version of ifOutMulticastPkts.
Pluggable Module Information* Description vendor-oui IEEE company ID of the manufacturer (not HP). This is defined in SFF-8472 in the Vendor OUI [Address A0h, Bytes 37-39] field. vendor-part-number Manufacturer part number (not an HP part number). This is defined in SFF-8472 in the Vendor OUI [Address A0h, Bytes 40-55] field. vendor-revision Manufacturer part revision number (not an HP part revision number). This is defined in SFF-8472 in the Vendor OUI [Address A0h, Bytes 56-59] field.
The following tables describe the rows within the FC Port Detailed Statistics screen.
Port Statistics Description fcInvalidTxWords Number of invalid transmission words fcSmoothingOverflowErrors Frames received with no receive buffer available due to buffer-to-buffer credit handling errors fcDecodeErrors Number of decode errors FC Bay Summary screen This screen provides a summary of the interconnect module status and port information. To remove a module, see "Interconnect module removal and replacement (on page 265).
Row Description Uplink Ports Used Number of uplink ports used to connect to the SAN. This number specifies the oversubscription ratio (4:1, 8:1, or 16:1). The following table describes the rows within the Interconnect Bay Information table in the Bay Summary screen.
Column Description HBA Port HBA port number Server Blade Server blade bay location SAN Fabric Name of the SAN Fabric connected to this port To edit the SAN Fabric, click the SAN Fabric in the left navigation tree.
Interconnect Bay VC Status icon definitions Icon Operational state Meaning Corrective action OK Device is fully operational. None Unknown Device operational state cannot be Check Onboard Administrator determined. communication. Disabled Device is disabled. Enable the component in Virtual Connect Manager. Initializing Device is initializing. Wait until initialization is complete. (This icon should only be seen at startup.) Unavailable Device is active but unable to provide service.
Server Bays Summary screen Device bay numbering is affected by whether the 'Allow the double density device bays' option was selected while using the Domain Setup Wizard. Bays might appear as 'Covered' or 'Unknown.' For more information, see "Double-dense server bay option (on page 254)." If a multi-blade server is installed, the bay numbering shows a span of bays, for example, Bays 1-4, in the Bay column. For more information, see "Multi-blade servers (on page 162).
in physical Bay 1, Bay 1 in VC Manager is displayed as COVERED, and Bays 1A and 1B display the appropriate double-dense server blade information. If the VC domain is configured for double-dense server mode, and a profile is assigned to an empty double-dense server bay, then a hot-plug installation of a single-dense server into the corresponding single-dense server bay results in the profile not being activated because the profile is not assigned to the single-dense server bay.
If the Onboard Administrator is downgraded to a version lower than 3.70, subsequent recovery of the double-dense enabled enclosure might result in bays A and B being marked 'Unknown.
Integrity blade devices Server Bay Overall Status icon definitions Icon Operational state Meaning Corrective action OK Device is fully operational. None Unknown Device operational state cannot be Check Onboard Administrator determined. communication. Initializing Device is initializing. Wait until initialization is complete. (This icon should only be seen at startup.) Profile pending Device has a pending profile assignment. The profile might need changes that require power cycling the server.
Icon Operational state Meaning (orange) Corrective action configuration attributes. Incompatible Device does not match the configuration. BIOS version level is not at a level that supports Virtual Connect. No communication Cannot communicate with the device. Check the physical connections and IP address. Missing data VCM is missing data about one or more blades in the multi-blade server.
Icon Operational state Meaning Corrective action Missing Device is configured but not accessible. Device is not operational because of an error. Insert the correct hardware module. Failed Reset the device or application, or replace the device. Server Bay OA Communication Status icon definitions Icon Operational state Meaning Corrective action OK Device is fully operational. None Failed Cannot communicate with the device.
Server Bay Status screen To change the power state of the server, click Momentary Press. If the server is powered on, click Press and Hold to force a shutdown. The following table describes the rows within the Server Bay Status table in the Server Bay Status screen. Server Bay Status NOTE: Servers connected through VC 8Gb 24-Port FC Modules can take between 15 and 25 seconds to recover from a module uplink port failure.
Row Description Overall Status Represents the worst condition of Hardware Status, VC Status, and OA Communication Status Hardware Status Component health status from the Onboard Administrator VC Status Component health status from the Virtual Connect Manager Assigned Server Profile Name of the profile currently assigned to the server blade in this bay Enclosure Name Name of the enclosure where this server blade is installed UID Icon indicates whether the UID is on or off.
Column Description Port Number Relative Fibre Channel Port number Adapter Mezzanine number where the HBA is connected Module Port Module bay number and module port number to which the device is connected Model Type of mezzanine installed WWN World Wide Port Name of the port, either assigned by Virtual Connect or as provided by the hardware SAN Fabric Module bay number and module port number of the SAN fabric Server Bay Status screen - multi-blade servers To change the power state of the serve
The following table describes the rows within the Server Blade Information table in the Server Bay Status screen.
Port status conditions Port status information appears on several screens throughout the GUI. If a port status is unlinked and no connectivity exists, one of the following causes appears: • Not Linked/E-Key—The port is not linked due to an electronic keying error. For example, a mismatch in the type of technology exists between the server and module ports. • Not Logged In—The port is not logged in to the remote device.
Interconnect module removal and replacement Virtual Connect modules In VC releases prior to 3.00, when a module was removed from an enclosure and was no longer in use by the domain, it had to be removed from the domain using the "Remove from Domain" feature available in the GUI and VCM CLI. Starting with VC firmware version 3.00, it is no longer necessary to remove the module from the domain if the module is not in use.
Upgrading to an HP Virtual Connect 8Gb 24-Port FC Module Upgrading to an HP VC 8Gb 24-Port FC Module requires several important steps, depending on the starting configuration. Replacing an HP 4Gb VC-FC Module, HP VC 4Gb FC Module, or HP 8Gb 20-Port FC Module with an HP VC 8Gb 24-Port FC Module 1. If necessary, upgrade the VC domain firmware. (Minimum v2.10 or higher is required to support the HP VC 8Gb 24-Port FC Module). 2. Verify that the replacement will result in a good configuration.
7. Ensure that the VC-FC modules are no longer shown in the domain. 8. Install the HP VC 8Gb 20-port FC Modules. 9. Re-create previously deleted FC SAN fabrics. 10. Re-assign the server profiles, and then add the FC connections to the profiles. Possible errors If the previous steps are not followed exactly, the module might be set to the UNKNOWN or INCOMPATIBLE state depending on how the error state was reached. The module should be physically removed. Then, the correct module type can be inserted.
4. Remove all network uplinks from the modules to be removed. 5. Remove the existing modules from both horizontally adjacent bays. 6. Ensure that the modules are removed from the Virtual Connect GUI. If the modules still appear on the GUI, there are still profiles with connections to the modules or networks with uplinks on the modules. Do not proceed until the modules are removed. 7. Install the HP Virtual Connect Flex-10, FlexFabric, or Flex-10/10D modules. 8.
If the previous steps have been followed and the server is not connecting properly to the network, power down the server, and then power it back up. Upgrading to an HP Virtual Connect FlexFabric module from a VC-FC module Replacing any VC-FC module with an HP VC FlexFabric module: 1. If necessary, upgrade the VC domain firmware. (Minimum v3.15 or higher is required to support an HP VC FlexFabric module). 2. Verify that the replacement will result in a good configuration.
Maintenance and troubleshooting Domain Status summary The Domain Status summary provides a count of Virtual Connect elements that are in an alert status other than OK. Virtual Connect elements summarized here include networks, shared uplink sets, server profiles, interconnect modules, and server blades. To view a summary of systems that have an alert icon displayed, click the Domain Status link. See "Domain Status screen (on page 271).
Icon Status Description Informational — Domain Status screen This screen provides an overall domain status and a detailed summary of systems that currently have an alert status other than OK.
VC displays cause and root cause information for domain status alerts. To view detailed information about a device, click that device name in the list. Export support information Virtual Connect Manager enables you to generate a support log, which can then be exported for technical support assistance. This operation is available to users with the Export Support Files role operation assigned their VC role. For more information, see "Role Management (Role Operations) screen (on page 83).
• Ethernet switch status and configuration information • Operating system status information • Directory listings • Boot Loader environment variables The time required to export support information varies depending on your Virtual Connect configuration and might require several minutes to complete. If you are using a proxy server to connect to the Virtual Connect Manager, configure it so that long connections do not time out.
• If a switch other than a Virtual Connect Ethernet switch is connected to any port in the profile, the profile is assigned, but the MAC address is not changed on the NIC. The connections display a status of “Not mapped” when viewing the profile. • If the number of Fibre Channel connections in the profile is more than the number of physical Fibre Channel HBA ports, the profile is assigned, but the connections display a status of “Not mapped” when viewing the profile.
• Making modifications to a profile that affect settings on the server blade; for example, PXE enable/disable, changing the number of connections, or changing Fibre Channel boot parameters • Assigning a VC-assigned serial number The following operations do not require the server blade to be powered off: • Changing the network connected to an already defined Ethernet port • Changing the Fabric connected to a Fibre Channel port • Changing the speed of a Fibre Channel port • Assigning or unassignin
Restart after OA credential recovery The state, "profile recovered," is applied to servers that are powered on when VC Manager restarts after an OA credential recovery. When VC Manager detects a restart after a credential recovery, it rewrites the profile parameters for any server that is powered on, connects the server to the appropriate Ethernet networks and FC fabrics, and then puts the server and profile in the "profile recovered" state.
Appendix: Using Virtual Connect with nPartitions Understanding nPartitions The HP BL870c i4 or HP BL980c i4 servers can be partitioned into separate, smaller servers, called nPartitions, using iLO. Each nPartition is treated identically to a server of comparable size and type. The set of blades that are conjoined by a Blade Link is referred to as a Blade Link Domain. An nPartition must be wholly contained within a blade link domain. The configuration of nPars is explained below.
iLO controls the blade link to change the configuration of nPars in the blade link domain, and the information about the new configuration is communicated through the OA to VCM. During the process, VCM: • Removes profile connections from affected nPars • Updates its nPar configuration information • Applies profiles to the new or modified nPars Assigning a VC profile to an nPar When an i4 server is configured with multiple nPartitions, each nPartition must be assigned its own profile.
When the reconfiguration is done, the OA generates blade remove events for the first two blades, resulting in VCM treating the AA partition as having been removed. Then the OA generates a blade add event for the first blade that identifies it as a single-blade partition, and likewise for the second blade. No events (remove or add) occur for the third and fourth blades because the C and D partitions are not affected by the reconfiguration.
Support and other resources Before you contact HP Be sure to have the following information available before you call HP: • Active Health System log (HP ProLiant Gen8 or later products) Download and have available an Active Health System log for 3 days before the failure was detected. For more information, see the HP iLO 4 User Guide or HP Intelligent Provisioning User Guide on the HP website (http://www.hp.com/go/ilo/docs).
Acronyms and abbreviations BPDU Bridge Protocol Data Unit CFG constant frequency generator CHAP Challenge Handshake Authentication Protocol CHAPM Mutual Challenge Handshake Authentication Protocol CMC centralized management console DNS domain name system DO data object FC Fibre Channel FCoE Fibre Channel over Ethernet FCS Frame Check Sequence GMII Gigabit media independent interface HBA host bus adapter Acronyms and abbreviations 281
IGMP Internet Group Management Protocol IQN iSCSI qualified name LACP Link Aggregation Control Protocol LAG link aggregation group LAG ID link aggregation group ID LDAP Lightweight Directory Access Protocol LHN LeftHand Networks LLDP Link Layer Discovery Protocol LUN logical unit number MAC Media Access Control NPIV N_Port ID Virtualization OA Onboard Administrator PHY physical layer device PLS physical signaling Acronyms and abbreviations 282
POST Power-On Self Test QoS Quality of Service RADIUS Remote Authentication Dial-In User Service RBSU ROM-Based Setup Utility RD receive data RMON remote monitoring SIM Systems Insight Manager SMI-S Storage Management Initiative Specification SNIA Storage Networking Industry Association SSH Secure Shell SSL Secure Sockets Layer TACACS+ Terminal Access Controller Access Control System Plus TCN Spanning Tree Topology Change Notification UDP User Datagram Protocol Acronyms and abbreviations 283
VCDG Virtual Connect Domain Group VCEM Virtual Connect Enterprise Manager VCM Virtual Connect Manager VCSU Virtual Connect Support Utility VID VLAN ID VLAN virtual local-area network WWN World Wide Name WWPN worldwide port name Acronyms and abbreviations 284
Documentation feedback HP is committed to providing documentation that meets your needs. To help us improve the documentation, send any errors, suggestions, or comments to Documentation Feedback (mailto:docsfeedback@hp.com). Include the document title and part number, version number, or the URL when submitting your feedback.
Index A About menu 16 accessing HP Virtual Connect Manager 12 ActiveX 11 activity indicator 18 adding a credential 30 adding a RADIUS group 78 adding a user 66 adding an LDAP group 72 adding an SNMP trap destination 43 adding enclosures 25 adding FC connections 219 adding FCoE connections 219 adding new users 68 adding SNMP access 44 Advanced Network Settings 118 Advanced Profile Settings 177 assign server profiles 208, 278 attribute number 78 authorized reseller 280 B backup domain 27 backup module 62 ban
E H edit a network access group 90 edit a RADIUS group 78 edit a server profile 201 edit a shared uplink set 131 edit an Ethernet network 118, 121 edit SAN fabric 154 editing a credential 30 enable strong passwords 66 enabling throughput statistics 95, 100 enclosure information 228 enclosure serial number 60 enclosure status information 230 enclosure, adding remote 25 enclosure, importing remote 25 enclosure, removing 27, 229 enclosures view 62, 63 Ethernet connections 177, 178, 186, 188, 189, 193, 195, 1
LDAP Server Settings (LDAP Server) 69 LDAP, configuration 68 licensed software and MACs or WWNs 222 local user accounts 66 logging in 13 login distribution 151, 159 login method, primary 66 M MAC address settings 173, 174 MAC address settings, managing 172 MAC address table, interconnect bay 237 MAC cache failover settings, configuring 95, 98 maintenance 270 managing networks 86 managing shared uplink sets 124 mapping profile connections 278 memory usage 233 menu map 16, 18 minimum requirements 69 Misc.
role management 82, 83 Role Operations 83 S SAN fabric, adding 208 SAN fabric, deleting 215 SAN Fabrics (External Connections) 156 SAN Fabrics (Server Connections) 158 select monitored ports 94 serial number settings 176 serial number, enclosure 60 server bay status information, multi-blade servers 262 server bay, information 254 server bay, status information 260 server blade, powering down 274 server connections, viewing 122 server port information, interconnect bay 236 server profile list, printing 201
V VC administrative roles, understanding 64 VC domain checkpoint traps 41 VC Domain Managed Status Changed traps 37 VC Domain MIB traps 37 VC Module MIB traps 36 vcDomainStackingLinkRedundancyStatusChange 41 vcTestTrap 41 vendor attribute number 78 view Ethernet networks 121 view server connections 122 viewing throughput statistics 226 Virtual Connect documentation 8 Virtual Connect fabric 139 Virtual Connect modules 224, 265 Virtual Connect overview 9 Virtual Connect wizards 14 VLAN Capacity 97 VLAN taggin
