Red Hat Enterprise Linux Diagnostics and Troubleshooting

Instructions

The serverb system is configured with a iSCSI target named iqn.2021-10.com.example.lab:target1. The target is configured with an ACL that grants access only to the iqn.2021-10.com.example.lab:servera IQN. The target is configured without authentication.

Another administrator configured the servera system to use iqn.2021-10.com.example.lab:target1 as the target. The administrator can discover the target, but cannot log in to it. Troubleshoot, identify, and correct the issue so that the initiator can successfully log in to the target.

1. Log in to servera and switch to the root user.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...
   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]#

2. Verify that the client cannot log in to the target and that no active sessions exist.

   1. Verify that the system has a successfully discovered target.

      [root@servera ~]# iscsiadm -m node
      172.25.250.11:3260,1 iqn.2021-10.com.example.lab:target1

   2. Verify that the system has no active sessions.

      [root@servera ~]# iscsiadm -m session
      iscsiadm: No active sessions.

   3. Attempt to log in to the target. Verify that the login fails, and view the displayed errors.

      [root@servera ~]# iscsiadm -m node -T iqn.2021-10.com.example.lab:target1 -l
      Logging in to [iface: default, target: iqn.2021-10.com.example.lab:target1, portal: 172.25.250.11,3260]
      iscsiadm: Could not login to [iface: default, target: iqn.2021-10.com.example.lab:target1, portal: 172.25.250.11,3260].
      iscsiadm: initiator reported error (24 - iSCSI login failed due to authorization failure)
      iscsiadm: Could not log into all portals

3. Using the -d diagnostic option, attempt to log in to the target again, and then view the extra debug information. Because the error messages indicated an authorization failure, look for debug messages with an "auth" keyword.

   [root@servera ~]# iscsiadm -m node -T iqn.2021-10.com.example.lab:target1 -l -d8
   ...output omitted...
   iscsiadm: updated 'node.session.auth.authmethod', 'None' => 'CHAP'
   ...output omitted...

4. The debug messages indicate that the initiator used CHAP authentication. Because the target uses no authentication, the initiator's authorization method is incorrect.

   1. Correct the configuration in /etc/iscsi/iscsid.conf by commenting out the following line:

      # node.session.auth.authmethod = CHAP

   2. Despite changing the initiator configuration, the previous target settings persist in the /var/lib/iscsi/nodes configuration cache. Clear the saved configuration with the iscsiadm command.

      [root@servera ~]# iscsiadm -m node -T iqn.2021-10.com.example.lab:target1 -o delete

   3. Restart the iscsid service.

      [root@servera ~]# systemctl restart iscsid

   4. Rediscover the target.

      [root@servera ~]# iscsiadm -m discovery -t st -p serverb.lab.example.com
      172.25.250.11:3260,1 iqn.2021-10.com.example.lab:target1

5. Attempt to log in to the target to verify that the login issue is resolved.

   [root@servera ~]# iscsiadm -m node -T iqn.2021-10.com.example.lab:target1 -l
   Logging in to [iface: default, target: iqn.2021-10.com.example.lab:target1, portal: 172.25.250.11,3260]
   iscsiadm: Could not login to [iface: default, target: iqn.2021-10.com.example.lab:target1, portal: 172.25.250.11,3260].
   iscsiadm: initiator reported error (24 - iSCSI login failed due to authorization failure)
   iscsiadm: Could not log into all portals

6. Despite fixing the initiator's authentication configuration, the issue persists. Verify that the initiator IQN matches the iqn.2021-10.com.example.lab:servera IQN as defined in the ACL.

   [root@servera ~]# cat /etc/iscsi/initiatorname.iscsi
   InitiatorName=iqn.2021-10.lab.example.com:servera

7. The initiator name is incorrectly configured because the domain name is not reversed. Fix the name and restart the iscsid service to implement the change.

   1. Fix the initiator name.

      [root@servera ~]# echo InitiatorName=iqn.2021-10.com.example.lab:servera > /etc/iscsi/initiatorname.iscsi

   2. Restart the iscsid service.

      [root@servera ~]# systemctl restart iscsid

8. Attempt to log in to the target to verify that the login issue is resolved.

   [root@servera ~]# iscsiadm -m node -T iqn.2021-10.com.example.lab:target1 -l
   Logging in to [iface: default, target: iqn.2021-10.com.example.lab:target1, portal: 172.25.250.11,3260]
   Login to [iface: default, target: iqn.2021-10.com.example.lab:target1, portal: 172.25.250.11,3260] successful.

9. Return to workstation as the student user.

   [root@servera ~]# exit
   [student@servera ~]$ exit
   [student@workstation ~]$