CSV ClusterStorage folder using Dell MD3600f being blocked by Firewall

[Fazza]

We're in the process of setting up our first ever Windows Failover Cluster using 2 Dell MD2600f SANs. The volumes are connected OK and appear in Disk Manager as expected and once assigned a drive letter (and formatted to NTFS) they have been successfully added to the Cluster Manager as CSVs (Cluster Shared Volumes) so 'Volume1' and 'Volume2' appear in the C:\ClusterStorage folder (like they should).

 

Then I installed our firewall software (Panda Adaptive Defence 360) and at that point the volumes become inaccessible and if you try to access them, File Explorer just freezes and then crashes. If I turn the FireWall off, then access to the 2 volumes on the SANs is regained and the mounted volumes work normally.

 

I've run all sorts of diagnostic software with Panda/Watchguard support to no avail.

 

There must be some software or a service (or something) that is running to communicate with the mounted SAN volumes that I need to allow through our Firewall - any ideas what I might need to unblock?

[Steve21]

We're in the process of setting up our first ever Windows Failover Cluster using 2 Dell MD2600f SANs. The volumes are connected OK and appear in Disk Manager as expected and once assigned a drive letter (and formatted to NTFS) they have been successfully added to the Cluster Manager as CSVs (Cluster Shared Volumes) so 'Volume1' and 'Volume2' appear in the C:\ClusterStorage folder (like they should).

 

Then I installed our firewall software (Panda Adaptive Defence 360) and at that point the volumes become inaccessible and if you try to access them, File Explorer just freezes and then crashes. If I turn the FireWall off, then access to the 2 volumes on the SANs is regained and the mounted volumes work normally.

 

I've run all sorts of diagnostic software with Panda/Watchguard support to no avail.

 

There must be some software or a service (or something) that is running to communicate with the mounted SAN volumes that I need to allow through our Firewall - any ideas what I might need to unblock?

 

Without knowing what the random AV software is actually doing, I’d assume one thing to check would be does it actually allow cluster service ports by default?

 

If it’s turning off windows firewall and locking it down you’d need to manually allow all those connections

 

But as a quick test you could just add a full unblock for the IPs of both SANs to see if it is that, then worry about finding individual ports later

 

Steve

[Fazza]

Without knowing what the random AV software is actually doing, I’d assume one thing to check would be does it actually allow cluster service ports by default?

 

If it’s turning off windows firewall and locking it down you’d need to manually allow all those connections

 

But as a quick test you could just add a full unblock for the IPs of both SANs to see if it is that, then worry about finding individual ports later

 

Steve

 

Hi!

 

I've added the 4 IP addresses of the SANs to be allowed through the Firewall (yes Windows Firewall is off so there is just this one Firewall running). The IP addresses are only for the management ports though so not quite sure if these are used to mount the Volumes on the SANs to the ClusterStorage folder on the root of drive C: but they still dont appear and File Explorer freezes/crashes still.

[PotNoodleTech]

It's either IP addresses or ports being blocked (or both?) you should be able to see the ports being used by the san's in the setup pages?

[Davit2005]

You'd prob need to find out the TCP/UDP ports been used and allow them.

 

TBH I'd prob look at disabling the firewall on the AV product and use Windows firewall that you can use with group policy to set the allowed traffic. If its a Windows service it might even be as a named application rather than jus relying on ports.

Edited May 18, 2023 by Davit2005

[Fazza]

You'd prob need to find out the TCP/UDP ports been used and allow them.

 

Hence why I started this thread asking if anyone knows what I need to unblock!

 

We are Cyber Essentials accredited so turning the firewall off is not viable.

 

I have the ports that the Failover Cluster uses unblocked (just in case) but the Failover Cluster itself works (and always has), it's only the mounted volumes from the SAN that fail when the firewall is enabled, I just need to know what to unblock to get it to work when the firewall is on.

 

I was hoping that someone else uses a SAN that they needed to allow through their firewall and if they could see what ports and/or programs that they unblocked to allow it to work as I cannot find any reference to such settings for a Dell MD3600f SAN.

 

[Steve21]

Hence why I started this thread asking if anyone knows what I need to unblock!

 

We are Cyber Essentials accredited so turning the firewall off is not viable.

 

I have the ports that the Failover Cluster uses unblocked (just in case) but the Failover Cluster itself works (and always has), it's only the mounted volumes from the SAN that fail when the firewall is enabled, I just need to know what to unblock to get it to work when the firewall is on.

 

I was hoping that someone else uses a SAN that they needed to allow through their firewall and if they could see what ports and/or programs that they unblocked to allow it to work as I cannot find any reference to such settings for a Dell MD3600f SAN.

 

 

Which ports have you unblocked so far?

 

Most firewalls would auto detect the rules for clusters, so I can check what we have but would be easier to know which you did already

 

Steve

[Primus]

Hi!

 

I've added the 4 IP addresses of the SANs to be allowed through the Firewall (yes Windows Firewall is off so there is just this one Firewall running). The IP addresses are only for the management ports though so not quite sure if these are used to mount the Volumes on the SANs to the ClusterStorage folder on the root of drive C: but they still dont appear and File Explorer freezes/crashes still.

 

You need to find the iSCSI IP addresses, the management ports are unlikely to carry the iSCSI traffic so adding them is unlikely to have worked I would have thought.

[Fazza]

It's either IP addresses or ports being blocked (or both?) you should be able to see the ports being used by the san's in the setup pages?

 

I've had a good look through the Dell software and I cant find any reference to any ports

 

 

 

You need to find the iSCSI IP addresses, the management ports are unlikely to carry the iSCSI traffic so adding them is unlikely to have worked I would have thought.

 

The Ethernet ports are purely for management so you're correct. The data from the SANs is via Fiber but I cant find any settings for iSCSI traffic in the Dell software and it's not something I remember configuring during the setup so they'll be on the default settings so I assume this was automatically configured by the OS somehow.

 

Off to investigate how to find out the what IPs iSCSI is using...

 

[Primus]

I've had a good look through the Dell software and I cant find any reference to any ports

 

[ATTACH=CONFIG]68977[/ATTACH]

 

 

 

 

The Ethernet ports are purely for management so you're correct. The data from the SANs is via Fiber but I cant find any settings for iSCSI traffic in the Dell software and it's not something I remember configuring during the setup so they'll be on the default settings so I assume this was automatically configured by the OS somehow.

 

Off to investigate how to find out the what IPs iSCSI is using...

 

 

Hold up, are you actually using iSCSI?

[Fazza]

Hold up, are you actually using iSCSI?

 

I read somewhere that the iSCSI protocol is being used but it's not using an iSCSI initiator.

 

The SANs are connected to the Servers via a fiber card. When we created the volumes on the SAN and assigned a LUN to it, the volumes then immediately appeared on the Servers in Disk Management so they could then be formatted and assigned a drive letter.

 

 

The Disks were then added to the cluster in the Failover Cluster Manager and then configured as a Cluster Shared Volume where it basically mounts the volume to a folder on the C: drive (rather than using a drive letter) and the Failover Cluster Manager then controls the volumes/disks.

 

 

With the Firewall on, File Explorer just sits there saying Working on it... and the volumes cannot be accessed - it's only when I turn the Firewall off that the 2 volumes appear and are useable:

 

 

I'm not sure what the Firewall is blocking (either ports or a program (or maybe service)), the Firewall logs are unclear that it's even blocking something relevant and I'm still waiting for Panda/Watchguard to respond further. As it's all gone quiet from Panda/Watchguard and I need to get this Failover Cluster running I'm having to try and work out what's getting blocked myself and with you guys helping!

Edited May 19, 2023 by Fazza

[Davit2005]

Worth installing Packet Capture on the server and monitor the ports connected to the Storage? Assuming this is not Fibre Channel as opposed to FCIP, FCoE or iSCSI

[Fazza]

Worth installing Packet Capture on the server and monitor the ports

 

If you mean monitor a physical port I'm not sure how I'd go about doing that as I've only seen that done on Ethernet and not Fiber?

[Davit2005]

If you mean monitor a physical port I'm not sure how I'd go about doing that as I've only seen that done on Ethernet and not Fiber?

#

 

So is the storage connection over Fibre Channel? and not using the Ethernet or IP protocols. Can you post the screenshot of host mappings from the Dell Storage?

Edited May 19, 2023 by Davit2005

[Fazza]

#

 

So is the storage connection over Fibre Channel? and not using the Ethernet or IP protocols. Can you post the screenshot of host mappings from the Dell Storage?

 

Here's how its all connected up on our test bench (once it's all sorted it will be rack mounted properly):

 

 

 

Here's a screenshot of the Host Mappings:

 

 

 

(THISONE Needs Attention because one of the RAID controllers needs a new battery which I ordered yesterday so that's all that's about )

 

 

Like I say, they function correctly and I can access both volumes when they they have just drive letters, but when you add the disks/volumes as CSV (Cluster Shared Volumes) the Failover Cluster takes over the management of the drives and mounts them as a folder on the C: drive and it's this that fails to function when the firewall is on.

 

Many thanks!