toasters March 2005

toasters@lists.teaparty.net

63 participants
88 discussions

RE: IPsec NFS to Unix clients
by Muhlestein, Mark 17 Jun '05

17 Jun '05

Gee, 30,000 * 300 is not even 10 million entries! :-) Yes, you are right that this isn't going to work in every case. But I wanted to mention it because it is useful in some situations. As to the MultiStore comment I made, I was thinking of a case where you want to use the same physical filer to serve an unprotected network (such as your normal campus network, it sounds like) and also serve a trusted network (on a different NIC or VLAN, say). As long as there is no way to access a vfiler's IP address using a client on the untrusted network, the vfiler boundary checks will prevent all access from all protocols (including NFS handle spoofing) coming from those untrusted clients. Mark -----Original Message----- From: Brian Parent [mailto:bparent@calvin.ucsd.edu] Sent: Friday, August 20, 2004 2:41 PM To: toasters(a)mathworks.com Subject: Re: IPsec NFS to Unix clients Thanks Mark. We do have CIFS. However, we have >30,000 accounts, and >300 NFS clients. And besides, any account is allowed access from any NFS client. Plus, it doesn't solve the problem of spoofing IPs. We don't have MultiStore, but even if we did, I don't see how it solves the problem of spoofing IPs. Spoofing IPs is painfully simple here, (as at most Universities, I would think) where labs aren't supervised, and network jacks are not physically secured. Re: > Subject: RE: IPsec NFS to Unix clients > Date: Fri, 20 Aug 2004 13:31:42 -0700 > From: "Muhlestein, Mark" <mark.muhlestein(a)netapp.com> > To: "Steve Losen" <scl(a)sasha.acc.virginia.edu>, > "Brian Parent" <bparent(a)calvin.ucsd.edu> > Cc: <toasters(a)mathworks.com> > > Here are a couple of other things you can do to improve NFS security: > > 1. If you have CIFS you might consider using the > nfs.require_valid_mapped_uid option. That allows you to set up the > usermap.cfg file to do things like this: > > # allow the following UIDs NFS access from the specified IP addresses > tom <= 192.168.3.34:tom > jerry <= jerrypc.dorm.foo.edu:jerry > jerry <= lab1.foo.edu:jerry > jerry <= lab2.foo.edu:jerry # etc. > > # allow root from the admin network > Administrator <= 10.10.20.0/24:root > > # prevent all other NFS access > "" <= * > > The nfs.require_valid_mapped_uid option causes the usermap.cfg entries > to be consulted even for access to data on qtrees with UNIX security. > Combined with the normal export controls, this approach works as long as > clients are not allowed to successfully spoof source IP addresses. It is > also more manageable if the number of combinations of users/hosts is not > overly large or dynamic; however I know we have had sites that have used > this type of approach with a script-generated usermap.cfg. > > 2. If you have MultiStore available you can also use that to fence off > NFS access. NFS clients accessing an IP address associated with a vfiler > are not allowed to access storage assigned to another vfiler. This is > enforced at the WAFL layer, so even if clients attempt handle spoofing > the access is denied as long as the potentially rogue clients are not > allowed to access the other vfilers' IP addresses (e.g. different > networks on separate NICs). > > Mark

2 2

SMB signing and my F760 ...
by Waters, G Scott RDECOM(THE LOG.SEC TEAM) 31 Mar '05

31 Mar '05

Does anyone have any experience with SMB signing?? We recently applied a DEBUG version of DoT 6.5.3 to our F760 in order to take advantage of SMB signing - a feature that won't be available until a later release of DoT 7.x - which won't be available for the F760's. With the SMB signing turned on we are seeing a much higher load on the filer's CPUs. NetApp analyzed some Performance Data and say that the SMB signing module is adding a 30% load to our FILER CPUs. What would you think? Is SMB signing that CPU intensive or would you think it could be sloppy code?? The performance hit is soo drastic I really have a hard time believing it is anything but bad coding (or maybe a little of both). NetApp Support's solution was to turn off SMB signing. Of course they were not thinking at all when they said that - because why would anyone apply a DEBUG release of an OS whose only function was to add SMB signing if they did not need SMB signing???? Fortunately we have a new filer waiting for a data migration ... but I have serious concerns as to what this is going to do to my new filer. What does a 30% CPU load increase translate to on a FAS960?? ... 10% ... 15%?? How soon before I have to buy another FILER?? I don't want to drop this ... but NetApp doesn't want to pursue any resolution other than new hardware. Anyway ... does anyone have any comments / suggestions?? - Scott W.

4 3

experience with iSCSI from W2K3 servers?
by Rob Winters 30 Mar '05

30 Mar '05

Does anyone have feedback or gotchas about W2K3 accessing large iSCSI space on NetApp filers? With what hardware? HBA and/or software initiator? How about clustering W2K3 servers to a NetApp iSCSI target, or similar HA configurations? Thanks! /// Rob P.S. Yes, *this* is how well the MacOS X research is going... :-| -- Rob Winters SAIC, NASA Headquarters ISEM Contract rwinters(a)hq.nasa.gov

1 0

RE: Netapp trunking - no performance gain
by david byte 30 Mar '05

30 Mar '05

The catch with trunking is that a single host will not see performance gains, unless they are load balancing across 2 nics and the filer is load balancing in the exact same manner. (not likely, but it can occur as aaron notes) Generally, trunking is used for load aggregation to provide higher performance to a larger number of clients. If you are looking for higher throughput that about 100MB/s you should be talking with your Network Appliance SE about assisting in the configuration and design of the system. David Byte Senior Systems Engineer 918-461-9255 davidb(a)uptime.net -----Original Message----- From: aaron hirsch Sent: Wednesday, March 30, 2005 3:53 PM To: toasters(a)mathworks.com Subject: RE: Netapp trunking - no performance gain > I'm trying to setup trunking on a netapp connected to a Cisco 3550 >gigabit switch (OS vers.12 on the switch). Sorry no experience with this switch... > The odd thing is that when I setup two gigabit lines trunked together >from the netapp to the switch I saw no improvement in thoughtput >compared to a single gigabit line. Again, not familiar with this particular switch...however, I have setup an enviornment similar to what you described and did see performance increase instantly. Extreme Summit 200-48 with a FAS250. I created a single vif interface out of the 2 gige interfaces on the FAS250 and enabled sharing on the switch ports that they plug into. I then took two 10/100 cards on a server and bound them togther and enabled sharing on the ports for the switch too. I went from pushing about 10MB/sec from the server to 20MB/sec. As this is well below the theoretical maximum for two gige ports trunked together, 250MB/sec (125MB/sec each), the problem is that pushing so little data makes it hard to see how effectively the gige trunk works. So, to answer your original question, yes I have done it; but utilizing 10/100 cards doesn't do justice when testing performance on a gige device.

1 0

RE: Netapp trunking - no performance gain
by aaron hirsch 30 Mar '05

30 Mar '05

> I'm trying to setup trunking on a netapp connected to a Cisco 3550 >gigabit switch (OS vers.12 on the switch). Sorry no experience with this switch... > The odd thing is that when I setup two gigabit lines trunked together >from the netapp to the switch I saw no improvement in thoughtput >compared to a single gigabit line. Again, not familiar with this particular switch...however, I have setup an enviornment similar to what you described and did see performance increase instantly. Extreme Summit 200-48 with a FAS250. I created a single vif interface out of the 2 gige interfaces on the FAS250 and enabled sharing on the switch ports that they plug into. I then took two 10/100 cards on a server and bound them togther and enabled sharing on the ports for the switch too. I went from pushing about 10MB/sec from the server to 20MB/sec. As this is well below the theoretical maximum for two gige ports trunked together, 250MB/sec (125MB/sec each), the problem is that pushing so little data makes it hard to see how effectively the gige trunk works. So, to answer your original question, yes I have done it; but utilizing 10/100 cards doesn't do justice when testing performance on a gige device.

1 0

permission auditing with cifs clients
by Charles Roufay 30 Mar '05

30 Mar '05

Hello all, Is anyone aware of a tool that can audit cifs clients permission changes? Permissions are sometimes changed and we would like to know who and when the changes are made. Any ideas? Charles Roufay Network Administration Bluewater Energy Services B.V Marsstraat 33 2132 HR Hoofddorp Netherlands Tel 023 568 2800 - www.bluewater.nl ********************************************************************* This e-mail message may contain privileged/confidential information. It is intended solely for the addressee.If you are not the indicated addressee(or responsible for delivery to such a person), you shall neither read nor retain this message, copy or distribute it to anyone, or use this email for any other purpose. In such cases, please destroy the message immediately and notify the sender by reply email.

1 0

FW: reuse old NetApp shelf
by Maglinger, Paul 28 Mar '05

28 Mar '05

Agreed. _____ From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Scott Fischmann Sent: Saturday, March 26, 2005 19:28 To: Iain Barnetson Cc: toasters(a)mathworks.com Subject: RE: reuse old NetApp shelf Hello Iain: I think Tim's suggestion is a good one and worth considering. Regards, -- Scott Fischmann Union Computer Exchange, Inc. 6233 Idylwood Lane Minneapolis, Minnesota 55436 phone: (952) 935-7282 | fax: (952) 935-5056 email: scott(a)unioncomputer.com <mailto:scott@unioncomputer.com> "Helping our customers make each dollar go further - since 1991!" Iain Barnetson wrote on 3/26/2005, 4:41 PM: yeah yeah yeah Am I in the Ebay forum or something? I've had more replies offereing to buy these things or sell me something else than answers to the question...........good grief!! Please DO NOT email me trying to sell me something or buy something from me, ok? Thanks. _____ From: Timothy Naple [mailto:tnaple@BERKCOM.com <mailto:tnaple@BERKCOM.com> ] Sent: 26 March 2005 17:29 To: Iain Barnetson Subject: RE: reuse old NetApp shelf Ian, I could offer a trade for some generic shelves and disks that work fine on Windows. I could use the NetApp storage. If that sounds at all interesting, let me know. Thanks, Tim Timothy Naple tnaple(a)berkcom.com <mailto:tnaple@berkcom.com> 510-384-1033 Cell 510-644-1599 Office 510-644-1598 Fax Berkeley Communications Corporation 2990 San Pablo Avenue Berkeley, CA 94702 http://www.berkcom.com <http://www.berkcom.com/> -----Original Message----- From: Iain Barnetson [mailto:Iain.Barnetson@Halliburton.com <mailto:Iain.Barnetson@Halliburton.com> ] Sent: Saturday, March 26, 2005 5:20 AM To: toasters(a)mathworks.com <mailto:toasters@mathworks.com> Subject: RE: reuse old NetApp shelf I've tired low level formatting two of the disks using the Qlogic card bios facility which suceeded with no error messages. I then came back into windows and still couldn't do anything with the disks. I've tried creating a partition using both diskpart and gdisk32 but still no joy. Gdisk32 creates a partition but still windows wants to initialize the disks but can't. diskpart sits there using cpu cycles, so far for 3 hours, and doesn't seem to be doing very much. Any ideas how I can get these drives in a usuable state? _____ From: Fox, Adam [mailto:Adam.Fox@netapp.com <mailto:Adam.Fox@netapp.com> ] Sent: 25 March 2005 17:14 To: Iain Barnetson Subject: RE: reuse old NetApp shelf You'll probably have to low-level format the drives to use 512 byte blocks. I'm guessing Windows isn't thrilled with the 520-byte blocks that NTAP uses. -- Adam Fox adamfox(a)netapp.com <mailto:adamfox@netapp.com> _____ From: Iain Barnetson [mailto:Iain.Barnetson@Halliburton.com <mailto:Iain.Barnetson@Halliburton.com> ] Sent: Friday, March 25, 2005 11:50 AM To: toasters(a)mathworks.com <mailto:toasters@mathworks.com> Subject: Re: reuse old NetApp shelf I've got a couple of NetApp DS14 fibre disk shelves from our "old" filers that I'd like to reuse. I attached one of the shelves to a server using a Qlogic 2200 card and although Windows detected the drives correctly I couldn't partition them or anything - no specific error message just saying that it couldn't. What I'm wondering is: Should I use the Qlogic card facility to low level format them? Will that make them usable in Windows? Any suggestions on how I can implement RAID with these disks other than Windows software RAID? Regards, Iain

1 0

RE: reuse old NetApp shelf
by Iain Barnetson 27 Mar '05

27 Mar '05

Why do 'some' people that reply to these emails not read them first?? Tim, if you bothered to read my origignal emails you would see that it is you that is ignorant by replying in that fashion. If you can't be more helpful why not refrain from answering? I maybe inexerienced as far as reusing NetApp FC disks in this fashion, but as per my previous emails you would have seen that I know enough with out the 100's of people telling me that they need to be low level formatted - see 1 st and subsequent emails. That's not the problem I've got that done but I can not format them ala Windows 512 sectors. See previous comments about diskpart & gdisk32, etc. As for the response sugesting using a different shelf, well that wouldn't be reusing the DS14 would it? It's something I may have to do, but before doing so I thought I'd ask to see if anyone could suggest a way of 'reusing' the DS14 shelves. Now, your point about disk manufactures utilities to format the disks is a bit more along the right lines, at least it addresses the question. The details about the mylex is helpful, I'll check that out. Iain -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Timothy Naple Sent: 27 March 2005 02:28 To: Iain Barnetson; toasters(a)mathworks.com Subject: RE: reuse old NetApp shelf Ian, I apologize. A simple 'no thanks' would have done. I had no intention of bothering you. I was simply trying to help as I could tell from your previous posts that you were completely ignorant when it comes to fibre channel disk firmware, block size, formatting, RAID, etc. I was trying to provide a simple solution that you might understand. Your best option in my opinion would be using a 16 bay shelf with a hardware RAID module from the same manufacturer. I would use disks that have factory generic firmware and format them 512 bps. If you are set on using NetApp DS14's, then at least format the disks 512bps. Disk manufacturers provide free utilities and there are several expensive commercial sofftware options to accomplish this. Your hardware RAID options are limited. I can suggest the Mylex ExtremeRAID 3000 which is a PCI hardware fibre channel RAID card which is Windows compatible. This is a copper card with two HSSDC connectors so depending on which style LRC's you have, you may need to do some optical to copper conversion. Now the LRC and the disk firmware were designed for NetApp, so you would still be better off with generic disk firmware and a shelf designed to be Windows compatible. Better yet, just put these DS14's back on a filer and run FCP. Thank you, Tim -----Original Message----- From: "Iain Barnetson"<Iain.Barnetson(a)Halliburton.com> Sent: 3/26/05 2:41:19 PM To: "toasters(a)mathworks.com"<toasters(a)mathworks.com> Subject: RE: reuse old NetApp shelf yeah yeah yeah Am I in the Ebay forum or something? I've had more replies offereing to buy these things or sell me something else than answers to the question...........good grief!! Please DO NOT email me trying to sell me something or buy something from me, ok? Thanks. _____ From: Timothy Naple [mailto:tnaple@BERKCOM.com] Sent: 26 March 2005 17:29 To: Iain Barnetson Subject: RE: reuse old NetApp shelf Ian, I could offer a trade for some generic shelves and disks that work fine on Windows. I could use the NetApp storage. If that sounds at all interesting, let me know. Thanks, Tim Timothy Naple tnaple(a)berkcom.com 510-384-1033 Cell 510-644-1599 Office 510-644-1598 Fax Berkeley Communications Corporation 2990 San Pablo Avenue Berkeley, CA 94702 http://www.berkcom.com <http://www.berkcom.com/> -----Original Message----- From: Iain Barnetson [mailto:Iain.Barnetson@Halliburton.com] Sent: Saturday, March 26, 2005 5:20 AM To: toasters(a)mathworks.com Subject: RE: reuse old NetApp shelf I've tired low level formatting two of the disks using the Qlogic card bios facility which suceeded with no error messages. I then came back into windows and still couldn't do anything with the disks. I've tried creating a partition using both diskpart and gdisk32 but still no joy. Gdisk32 creates a partition but still windows wants to initialize the disks but can't. diskpart sits there using cpu cycles, so far for 3 hours, and doesn't seem to be doing very much. Any ideas how I can get these drives in a usuable state? _____ From: Fox, Adam [mailto:Adam.Fox@netapp.com] Sent: 25 March 2005 17:14 To: Iain Barnetson Subject: RE: reuse old NetApp shelf You'll probably have to low-level format the drives to use 512 byte blocks. I'm guessing Windows isn't thrilled with the 520-byte blocks that NTAP uses. -- Adam Fox adamfox(a)netapp.com <mailto:adamfox@netapp.com> _____ From: Iain Barnetson [mailto:Iain.Barnetson@Halliburton.com] Sent: Friday, March 25, 2005 11:50 AM To: toasters(a)mathworks.com Subject: Re: reuse old NetApp shelf I've got a couple of NetApp DS14 fibre disk shelves from our "old" filers that I'd like to reuse. I attached one of the shelves to a server using a Qlogic 2200 card and although Windows detected the drives correctly I couldn't partition them or anything - no specific error message just saying that it couldn't. What I'm wondering is: Should I use the Qlogic card facility to low level format them? Will that make them usable in Windows? Any suggestions on how I can implement RAID with these disks other than Windows software RAID? Regards, Iain

1 0

RE: reuse old NetApp shelf
by Iain Barnetson 27 Mar '05

27 Mar '05

yeah yeah yeah Am I in the Ebay forum or something? I've had more replies offereing to buy these things or sell me something else than answers to the question...........good grief!! Please DO NOT email me trying to sell me something or buy something from me, ok? Thanks. ________________________________ From: Timothy Naple [mailto:tnaple@BERKCOM.com] Sent: 26 March 2005 17:29 To: Iain Barnetson Subject: RE: reuse old NetApp shelf Ian, I could offer a trade for some generic shelves and disks that work fine on Windows. I could use the NetApp storage. If that sounds at all interesting, let me know. Thanks, Tim Timothy Naple tnaple(a)berkcom.com 510-384-1033 Cell 510-644-1599 Office 510-644-1598 Fax Berkeley Communications Corporation 2990 San Pablo Avenue Berkeley, CA 94702 http://www.berkcom.com <http://www.berkcom.com/> -----Original Message----- From: Iain Barnetson [mailto:Iain.Barnetson@Halliburton.com] Sent: Saturday, March 26, 2005 5:20 AM To: toasters(a)mathworks.com Subject: RE: reuse old NetApp shelf I've tired low level formatting two of the disks using the Qlogic card bios facility which suceeded with no error messages. I then came back into windows and still couldn't do anything with the disks. I've tried creating a partition using both diskpart and gdisk32 but still no joy. Gdisk32 creates a partition but still windows wants to initialize the disks but can't. diskpart sits there using cpu cycles, so far for 3 hours, and doesn't seem to be doing very much. Any ideas how I can get these drives in a usuable state? ________________________________ From: Fox, Adam [mailto:Adam.Fox@netapp.com] Sent: 25 March 2005 17:14 To: Iain Barnetson Subject: RE: reuse old NetApp shelf You'll probably have to low-level format the drives to use 512 byte blocks. I'm guessing Windows isn't thrilled with the 520-byte blocks that NTAP uses. -- Adam Fox adamfox(a)netapp.com ________________________________ From: Iain Barnetson [mailto:Iain.Barnetson@Halliburton.com] Sent: Friday, March 25, 2005 11:50 AM To: toasters(a)mathworks.com Subject: Re: reuse old NetApp shelf I've got a couple of NetApp DS14 fibre disk shelves from our "old" filers that I'd like to reuse. I attached one of the shelves to a server using a Qlogic 2200 card and although Windows detected the drives correctly I couldn't partition them or anything - no specific error message just saying that it couldn't. What I'm wondering is: Should I use the Qlogic card facility to low level format them? Will that make them usable in Windows? Any suggestions on how I can implement RAID with these disks other than Windows software RAID? Regards, Iain

2 1

RE: reuse old NetApp shelf
by Timothy Naple 27 Mar '05

27 Mar '05

Ian, I apologize. A simple 'no thanks' would have done. I had no intention of bothering you. I was simply trying to help as I could tell from your previous posts that you were completely ignorant when it comes to fibre channel disk firmware, block size, formatting, RAID, etc. I was trying to provide a simple solution that you might understand. Your best option in my opinion would be using a 16 bay shelf with a hardware RAID module from the same manufacturer. I would use disks that have factory generic firmware and format them 512 bps. If you are set on using NetApp DS14's, then at least format the disks 512bps. Disk manufacturers provide free utilities and there are several expensive commercial sofftware options to accomplish this. Your hardware RAID options are limited. I can suggest the Mylex ExtremeRAID 3000 which is a PCI hardware fibre channel RAID card which is Windows compatible. This is a copper card with two HSSDC connectors so depending on which style LRC's you have, you may need to do some optical to copper conversion. Now the LRC and the disk firmware were designed for NetApp, so you would still be better off with generic disk firmware and a shelf designed to be Windows compatible. Better yet, just put these DS14's back on a filer and run FCP. Thank you, Tim -----Original Message----- From: "Iain Barnetson"<Iain.Barnetson(a)Halliburton.com> Sent: 3/26/05 2:41:19 PM To: "toasters(a)mathworks.com"<toasters(a)mathworks.com> Subject: RE: reuse old NetApp shelf yeah yeah yeah Am I in the Ebay forum or something? I've had more replies offereing to buy these things or sell me something else than answers to the question...........good grief!! Please DO NOT email me trying to sell me something or buy something from me, ok? Thanks. _____ From: Timothy Naple [mailto:tnaple@BERKCOM.com] Sent: 26 March 2005 17:29 To: Iain Barnetson Subject: RE: reuse old NetApp shelf Ian, I could offer a trade for some generic shelves and disks that work fine on Windows. I could use the NetApp storage. If that sounds at all interesting, let me know. Thanks, Tim Timothy Naple tnaple(a)berkcom.com 510-384-1033 Cell 510-644-1599 Office 510-644-1598 Fax Berkeley Communications Corporation 2990 San Pablo Avenue Berkeley, CA 94702 http://www.berkcom.com <http://www.berkcom.com/> -----Original Message----- From: Iain Barnetson [mailto:Iain.Barnetson@Halliburton.com] Sent: Saturday, March 26, 2005 5:20 AM To: toasters(a)mathworks.com Subject: RE: reuse old NetApp shelf I've tired low level formatting two of the disks using the Qlogic card bios facility which suceeded with no error messages. I then came back into windows and still couldn't do anything with the disks. I've tried creating a partition using both diskpart and gdisk32 but still no joy. Gdisk32 creates a partition but still windows wants to initialize the disks but can't. diskpart sits there using cpu cycles, so far for 3 hours, and doesn't seem to be doing very much. Any ideas how I can get these drives in a usuable state? _____ From: Fox, Adam [mailto:Adam.Fox@netapp.com] Sent: 25 March 2005 17:14 To: Iain Barnetson Subject: RE: reuse old NetApp shelf You'll probably have to low-level format the drives to use 512 byte blocks. I'm guessing Windows isn't thrilled with the 520-byte blocks that NTAP uses. -- Adam Fox adamfox(a)netapp.com <mailto:adamfox@netapp.com> _____ From: Iain Barnetson [mailto:Iain.Barnetson@Halliburton.com] Sent: Friday, March 25, 2005 11:50 AM To: toasters(a)mathworks.com Subject: Re: reuse old NetApp shelf I've got a couple of NetApp DS14 fibre disk shelves from our "old" filers that I'd like to reuse. I attached one of the shelves to a server using a Qlogic 2200 card and although Windows detected the drives correctly I couldn't partition them or anything - no specific error message just saying that it couldn't. What I'm wondering is: Should I use the Qlogic card facility to low level format them? Will that make them usable in Windows? Any suggestions on how I can implement RAID with these disks other than Windows software RAID? Regards, Iain

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters March 2005