NAC - Global Device Filter in OOB deployment

Hi,
Some help would be appriciated. I'm trying to bypass authentication/posture assessment for a printer in an OOB NAC deployment (CAM/CAS Version 4.9.0
I added the device MAC address in the global device filter, with the ALLOW access type set.
"Change VLAN according to global device filter list" option is checked in the port profile set on the corresponding switch port.
However, the device ends up in the Auth VLAN every time...
What am I missing?

Hi Tarik,
Yes, the port is managed and a test profile named 'Printer_test' is currently assigned to the port.
Here is what I see in the nac manager.log file (level set to debug) after the port comes up:
2012-01-24 14:41:08.219 +0100   DefaultUDPTransportMapping_0.0.0.0/162 DEBUG com.perfigo.wlan.web.sms.SnmpTrapListener          - Received trap event SwitchTrapEvent [type=LINK_UP switch_ip=10.1.0.32 mac=null port=10035 dot1dBasePort=0 vlan=0]
2012-01-24 14:41:08.219 +0100   DefaultUDPTransportMapping_0.0.0.0/162 DEBUG com.perfigo.wlan.web.sms.SnmpRunnable              - SnmpRunnable com.perfigo.wlan.web.sms.task.SwitchNotificationTask id=5091348 is created: SwitchTrapEvent [type=LINK_UP switch_ip=10.1.0.32 mac=null port=10035 dot1dBasePort=0 vlan=0]
2012-01-24 14:41:08.219 +0100   DefaultUDPTransportMapping_0.0.0.0/162 DEBUG com.perfigo.wlan.web.sms.SnmpManager               - Task from device 10.1.0.32 submitted with task id 5091348
2012-01-24 14:41:08.219 +0100   pool-3-thread-16 DEBUG com.perfigo.wlan.web.sms.SnmpRunnable              - SnmpRunnable com.perfigo.wlan.web.sms.task.SwitchNotificationTask id=5091348 starts run() after 0ms.
2012-01-24 14:41:08.219 +0100   pool-3-thread-16 DEBUG com.perfigo.wlan.web.sms.SnmpRunnable              - Resolved PortProfile Switch Port Profile [ id=4 name='Printer_test' type='normal' auth_vlan=100 access_vlan=15 idle_vlan=-1 attributes=635 vlan_profile_id=0 description='' reserved='' ] from event SwitchTrapEvent [type=LINK_UP switch_ip=10.1.0.32 mac=null port=10035 dot1dBasePort=0 vlan=0]
2012-01-24 14:41:08.220 +0100   pool-3-thread-16 INFO com.perfigo.wlan.web.sms.SnmpRunnable              - Received SNMP LINK_UP trap, but switch 10.1.0.32 is not using LINK_UP for task 5091348
2012-01-24 14:41:08.220 +0100   pool-3-thread-16 DEBUG com.perfigo.wlan.web.sms.SnmpRunnable              - Trap does not need to processed: SwitchTrapEvent [type=LINK_UP switch_ip=10.1.0.32 mac=null port=10035 dot1dBasePort=0 vlan=0] for task 5091348
2012-01-24 14:41:08.220 +0100   pool-3-thread-16 DEBUG com.perfigo.wlan.web.sms.SnmpRunnable              - SnmpRunnable com.perfigo.wlan.web.sms.task.SwitchNotificationTask id=5091348 ends run() after 1ms.
2012-01-24 14:41:08.220 +0100   pool-3-thread-16 DEBUG com.perfigo.wlan.web.sms.SnmpRunnable              - SnmpRunnable com.perfigo.wlan.web.sms.task.SwitchNotificationTask id=5091348 finishes after 1ms.

Similar Messages

NAC Server Fallback Feature and OOB Deployment

Hi,
I would like to know how the Nac Server fallback feature works in an OOB deployment.
The documentation says that there three option (ignore, allow all, block all).
Whe you have the allow all option enable, does the NAC put the user in an access vlan or the user just access to the network through the authentication VLAN?

Hi,
Assuming the CAM has failed, the CAS would allow all traffic from the AUTH VLAN to the ACCESS VLAN. Since the CAM has failed, the switchports which are not in the AUTH VLAN would behave per the rules/ACLs on the VLAN they're in and won't get flipped over.
HTH,
Faisal

Solaris Cluster and Global Devices for sapmnt

Hi,
IHAC that is considering using Global Devices for /usr/sapmnt in a SAP environment, since they need all SAP nodes looking for the same sapmnt area. Is this a recommended approach?
Generally, we are working with S11.1/Solaris Cluster 4.1 to implement Netweaver 7.2 and ERP 6.0.
I appreciate your comments.
Regards, Rafael.

Hi Rafael,
/usr/sapmnt is a file system, as such I assume when you ask about usage of global devices you really mean to ask about using a global file system (ie. an UFS file system with mount option global)?
If that is true, then the answer is yes.
The data service guide for SAP NetWeaver (http://docs.oracle.com/cd/E29086_01/html/E29440/installconfig-10.html#installconfig-34) does mention in the section "configuration considerations":
"The SAP enqueue server and SAP replica server run on different cluster nodes. Therefore, the SAP application files (binary files, configuration files, and parameter files) can be installed either on the global file system or on the local file system. However, the application files for each of these applications must be accessible at all times from the nodes on which these applications are running."
And the deployment example in the appendix (http://docs.oracle.com/cd/E29086_01/html/E29440/gmlbt.html#scrolltoc) makes use of a global mounted /sapstore file system.
Regards
Thorsten

NAC for wireless layer 3 oob

Hi,
Anyone implemented nac for wireless layer 3 oob? This is using nac appliance not ise.
What I did is to configure wlc as per layer 2 oob setup. Configure svi 669 (authentication/quarantine vlan) on switches that’s with the wism. Pbr all vlan 669 traffic to test cas untrusted interface.
Problem now I’m not able to get an ip from dhcp after associating. DHCP works when tested on wired. Is there any additional config to be done on WLC or am i doing it right??
The test cas/cam are ugraded to ver 4.8.2.
Regards
Joachim

Everyone can do a mistake and it seems I did a big one :-)
l3 wireless OOB was not supported until last version :
§Wireless L3 OOB RIP has been introduced in 4.8.2.
§In order to support wireless in L3 OOB RIP deployment – DHCP release and renew values were propagated from CAS to the client so that client can perform IP refresh.
§The configuration of WLC and AP’s needs to be done like in Wireless L2 OOB VGW deployments.
§There are no ports in WLC hence Port profile is not required
§WLC allows only two VLAN’s namely Quarantine (Auth) and Access VLAN’s. Hence the support for User role Vlans is not there in Wireless deployments.
§iPhone/iPad support is also not present. Reason being IP address cannot be refreshed in iPhone/iPad due to lack of support for Java Applet/ActiveX.
§The authentication trap control needs to be checked in order for the WLC to send 599.0.4 trap.

Cisco ACS v5.3 - Unable to define Device Filter

Dear Community!
I'm new to ACS version 5 family and I would like to ask if anybody has already experienced the following strange issue with ACS version 5.3.0.40 GUI: I have several AAA clients already defined in the "Network Devices and AAA Clients" menu and I need to create a new device filter in the
"Policy Elements > ... > Session Conditions > Network Conditions > Device Filters"
menu.
But unfortunately after clicking "Create" button, I cannot use any types of device filters :-( After filling in the device IP / name / or group and clicking "Go" button, nothing happens, the I always get no results, so I cannot select any device to be included into the device filter.
For example, I have an IPS device named "DC1IPSC010" and I'm trying to add this device to a new device filter with no luck.
What I have already tried:
Using full text which equals to DC1IPSC010.
Using partial text containing IPS.
Using Internet Explorer 9-10-11
Using FireFox v4.x and the latest v32 versions
Clearing my Java temporary files cache
Using different operating systems
My installed Java version is Java 1.7 update 51.
Has anybody experienced the same issue with this version? Are there any workarounds for this?
Many thanks in advance!
BR
Bela

I know this is a 2 year old thread, but you just saved me from banging my head against a wall.
GUI credentials of super-admin should be in bold somewhere in the documentation.

How do I return a device licence to my deployment pool?

How do I return a device license to my deployment pool. I have created a package using CCP and deployed it to a test machine but now I need to return the license to my deployment pool. There is no obvious way of doing this via the deployed app or via the web interface (Team Management or My plan pages). The license is Creative Cloud for education (VIP), single app, for multiple devices.

Hi Patty Xyans mom,
You can remove your device from iCloud by following the steps in this article:
iCloud: Remove your device from Find My iPhone
http://support.apple.com/kb/PH2702
Hope this helps ....
- Judy

Global device issue in sun cluster3.2

In my 2 node cluster (sun cluster3.2) running on x86 VMs. One of my nodes VM1 does not have the global devices populated due to which i cannot failover my file system to node VM1 , what could be the reason for this and how can i rectify it ?
VM1:/>cd /dev/global
-bash: cd: /dev/global: No such file or directory
VM1:/>
VM2:/>cd /dev/global
VM2:/dev/global>ls
admin dsk    rdsk   rmt
VM2:/dev/global>
VM2:/>clnode status
=== Cluster Nodes ===
--- Node Status ---
Node Name                                       Status
VM2                                             Online
VM1                                             Online
VM2:/>clq status
=== Cluster Quorum ===
--- Quorum Votes Summary from latest node reconfiguration ---
            Needed   Present   Possible
            2        3         3
--- Quorum Votes by Node (current status) ---
Node Name       Present       Possible       Status
VM2             1             1              Online
VM1             1             1              Online
--- Quorum Votes by Device (current status) ---
Device Name       Present      Possible      Status
d3                1            1             Online
VM2:/>cldev status
=== Cluster DID Devices ===
Device Instance               Node              Status
/dev/did/rdsk/d2              VM1               Ok
                              VM2               Ok
/dev/did/rdsk/d3              VM1               Ok
                              VM2               OkEdited by: fugitive on Dec 8, 2009 5:58 PM

Can you check whether all the cluster SMF services are online on VM1?
# svcs -xv
-Venku

Confused about the /global/.devices/node@1 filesystem

This is the first cluster I have tried to build on Vmware with two shared scsi virtual disks.
The above filesystem appears on both nodes, but there is none called /global/.devices/node@2 visible.
The shared storage ( scsi ) does not work , if I create a file on one node it is invisible on the other and vice versa.
But If I put a file in /global/.devices/node@1 on one node I can see it on the other. But I thought /global/.devices/node@1 was a LOCAL filesystem.
I have trawled through lots of documentation , but nothing seems to give me any answers.
Can anyone give me an explanation or refer me to any docs relevant to this. Thanks !
George

Simple question.
Should I see a mounted filsesystem of /global/.devices/node@2 on the other node ? Does the absense of this indicate a problem ??
Now getting the following error when trying to configure ha-nfs.
The shared disks are definately visible to the operating system on both nodes :
## Define File-System Mount Point ##
Default Mount Directory: /shared
Raw-Device Path: /dev/did/rdsk/d2s0
ERROR: The raw-device path that you specified is not accessible from all
nodes that can master the highly available storage resource. Specify a
different path, change the nodes that can master the highly available
storage resource, or add the missing nodes to the node list of the device.
George

Cluster /global/devices/node@X mount problem.

Hi,
I have just installed sun cluster 3.2. It is a simple installtion and cluster contains only two servers and one sun storage.
After installation, i realised that the name of the metadevice on tha servers were the same, so only one of them mounted under /global/devices/node@X, and the other were didn't.
Then i re-create metadevice on the second node with another name. After re-creation /global/devices/node@X
fs weren't mounted, when node were rebooted.
there was various error on the console, but i couldn't resolve that problem.
I can mount global/devices/node@X with mount command. But it's not mounted automaticaly in reboot time.
# mount global/devices/node@X is running perfectly.
The error shown in reboot time are as follows;
The /global/.devices/node@2 file system (/dev/rlofi/1) is being checked.
WARNING - Unable to repair the /global/.devices/node@2 filesystem. Run fsck
manually (fsck -F ufs /dev/rlofi/1).
Mar 18 13:35:12 svc.startd[8]: svc:/system/cluster/scmountdev:default: Method "/usr/cluster/lib/svc/method/scmountdev start" failed with exit status 32.
The /global/.devices/node@2 file system (/dev/rlofi/1) is being checked.
WARNING - Unable to repair the /global/.devices/node@2 filesystem. Run fsck
manually (fsck -F ufs /dev/rlofi/1).
Mar 18 13:35:12 svc.startd[8]: svc:/system/cluster/scmountdev:default: Method "/usr/cluster/lib/svc/method/scmountdev start" failed with exit status 32.
The /global/.devices/node@2 file system (/dev/rlofi/1) is being checked.
WARNING - Unable to repair the /global/.devices/node@2 filesystem. Run fsck
manually (fsck -F ufs /dev/rlofi/1).
Mar 18 13:35:12 svc.startd[8]: svc:/system/cluster/scmountdev:default: Method "/usr/cluster/lib/svc/method/scmountdev start" failed with exit status 32.
mount: I/O error
mount: Cannot mount /dev/lofi/126
lofiadm: could not unmap device /dev/lofi/126: No such device or address
mount: I/O error
mount: Cannot mount /dev/lofi/126
lofiadm: could not unmap device /dev/lofi/126: No such device or address
WARNING: Cluster startup could not remove the existing
lofi device associated with /.globaldevices. Try manually
removing the device association. Global devices will
be unavailable until this error is fixed.
Mar 18 13:36:10 tstclstr1 svc.startd[8]: system/cluster/globaldevices:default misconfigured: transitioned to maintenance (see 'svcs -xv' for details)
Mar 18 13:36:10 tstclstr1 Cluster.CCR: /usr/cluster/bin/scgdevs: Filesystem /global/.devices/node@2 is not available in /etc/mnttab.
Mar 18 13:36:10 tstclstr1 last message repeated 1 time
Mar 18 13:38:50 tstclstr1 svc.startd[8]: platform/sun4u/dscp:default failed: transitioned to maintenance (see 'svcs -xv' for details)
The output of the svcs -xv;
root@tstclstr1 # svcs -xv
svc:/system/cluster/globaldevices:default (Suncluster globaldevices service)
State: maintenance since 18 Mart 2010 Perşembe 13:36:10 EET
Reason: Start method exited with $SMF_EXIT_ERR_CONFIG.
See: http://sun.com/msg/SMF-8000-KS
See: /var/svc/log/system-cluster-globaldevices:default.log
Impact: 3 dependent services are not running:
svc:/system/cluster/mountgfs:default
svc:/system/cluster/clusterdata:default
svc:/system/cluster/ql_rgm:default
svc:/application/print/server:default (LP print server)
State: disabled since 18 Mart 2010 Perşembe 13:34:46 EET
Reason: Disabled by an administrator.
See: http://sun.com/msg/SMF-8000-05
See: man -M /usr/share/man -s 1M lpsched
Impact: 2 dependent services are not running:
svc:/application/print/rfc1179:default
svc:/application/print/ipp-listener:default
svc:/system/cluster/scmountdev:default (Sun Cluster scmountdev)
State: maintenance since 18 Mart 2010 Perşembe 13:35:12 EET
Reason: Start method failed repeatedly, last exited with status 32.
See: http://sun.com/msg/SMF-8000-KS
See: /etc/svc/volatile/system-cluster-scmountdev:default.log
Impact: This service is not running.
svc:/system/cluster/scsymon-srv:default (Sun Cluster SyMON Server Daemon)
State: offline since 18 Mart 2010 Perşembe 13:34:49 EET
Reason: Dependency svc:/application/management/sunmcagent:default is absent.
See: http://sun.com/msg/SMF-8000-E2
Impact: This service is not running.
svc:/platform/sun4u/dcs:default (domain configuration server)
State: maintenance since 18 Mart 2010 Perşembe 13:38:51 EET
Reason: Restarting too quickly.
See: http://sun.com/msg/SMF-8000-L5
See: man -M /usr/share/man -s 1M dcs
See: /var/svc/log/platform-sun4u-dcs:default.log
Impact: This service is not running.
svc:/platform/sun4u/dscp:default (DSCP Service)
State: maintenance since 18 Mart 2010 Perşembe 13:38:50 EET
Reason: Start method failed repeatedly, last died on Killed (9).
See: http://sun.com/msg/SMF-8000-KS
See: man -M /usr/share/man -s 1M prtdscp
See: /var/svc/log/platform-sun4u-dscp:default.log
Impact: This service is not running.
{noformat}root@tstclstr1 #
</pre>{noformat}

Thanks for the reply,
It used to be the same metaset name on the second server, which several folks have run into when installing SC on the 2nd node. So I renamed it when booted into no cluster mode using metarename. I then updated the /etc/vfstab with the new name, this is it in /etc/vfstab:
/dev/md/dsk/d26 /dev/md/rdsk/d26 /global/.devices@2 ufs 2 no global
And yes if I change "global" to "-" then it mounts. When the 2nd node boots up, it cannot mount /global/.devices@2 with it set to global so the boot halts, I do ctrl-D to continue. Then I try a regular mount from root and I get the "no such file or directory" message.
If I do a metastat d26 it shows it to be OK on both submirrors.
The name of the metadisk on the first node is d160. And the 2nd server is able to mount that from the global option on the first server.
Thanks,

Adding an additional CAS to an existing NAC OOB deployment 4.7.3

Hi Guys,
If I am to add the Self-generated certificate of my new CAS to my existing CAM's trusted certificate authorities list, will it just be added or will it replace the existing trusted certificate?

Hi Adrian,
The 'trusted certificate authorities' are the certificate of all the root CAs and also the self signed certs of the CASes that the CAM trusts. So every time you add a root/selfsigned cert to this list it gets appended to the list and does not replace any of the certs.This link gives more information on this :
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/45/cas/s_admin.html#wp1092761
Regards,
Som
P.S.: Please mark the question resolved if it has been answered. Do rate helpful posts. Thanks

NAC 4.7.1 L3 OOB - Temporary Role bugs ?

Hi
We have a L3 OOB routed gateway configuration (with redundant CAS and CAM), We are currently running 4.7.1 on the appliances and the agent is 4.7.10.
We have experienced two problems:
1. On several occasions we can abort a valid logon, but can still be allowed access to the network 'silently' ;
a - without any indication on the CAM i.e. no online users, no certified devices
b - the switch is still in the 'unauthenticated vlan' and the
c - ip address of the client is on the 'untrusted' subnet.
d - the 'unauthenticated' policy DOES NOT ALLOW web traffic.
It would seem that the user is able to trick the system by aborting the logon with the agent i.e. closing the window etc, (the login credentials are
correct and posture fails on an optional check and so amber) but the system DOES NOT show the user at all.
The Temporary role does allow full access, if I disable the policy rule the traffic is stopped.
The problem is there is no indication of this user on the system at all, this happens a couple of times a week.
2. When a user is genuinely placed into a TEMPORARY role (as indicated by the system, note: not the same as above),
about 50% of the time communication is blocked even though the policy allows it (repeated challenges by NAC).
Close the agent and do it the second time and it will work.
I think the symptoms are related as they both seem to be related to the usage of the TEMPORARY ROLE - has anyone else seen this bug ?

Hi,
You said not to configure a quarantine vlan, but by the time the users get connected how is gonna be the process for authentication (quarantine) and access vlan??? I mean how is it going to perform the nac process and how to control what happens if it fails (not in compliance) or if it suceed??
It seems that the version 4.9(1) has the integration, but is not so clear:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cam/m_woob.html#wp1139585
What versions were you running in your deployment.

NAC Certified Devices

Guys,
I have a NAC with two roles configured "Person" and "Person1" and I saw that when Person is authenticated it's put on Online users OOB and certified Devices but when Person1 is authenticated it's just appear as Online users OOB but does not appear on Certified Devices.
Why this? and How can I put Person1 role in Certified Devices after authenticated?
thanks a lot

You would only see the user in the "Certified Devices" if the user is L2 to the server (as Certified Devices List is based on client MAC addresses).
Here is more explaination on "Certified Devices" for your reference:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/47/cam/m_report.html#wp1479058
Hope it helps.

Delivery Assignment to Device group in standalone deployment?

Hi,
I am using the standalone deployment of SAP AII 2.1. I have the following two queries regarding assignment of deliveries to device groups.
1. I am able to assign the same delivery to multiple device groups with same business roles as well as different business roles at the same time.
For example, I am assigning the delivery to a device group that handles tag commissioning and I also assign the same delivery to a device group that handles the loading at the same time. Is this the correct behavior?
Or is it that once a delivery is assigned to a device group, it should be first processed by that device group or unassigned before the same delivery can be assigned to a different device group?
If this is the case, then is there any configuration setting in AII that can control the delivery assignment to device groups?
2. Logically I believe that only one delivery can be assigned to a device group.
I assign a delivery to a device group. Then I immediately assign another delivery to the same device group. I believe that the first delivery gets unassigned from the device group, but there is no message to this effect
Again is there any configuration setting for handling this situation?
Regards,
Dhananjay

What you are deploying is a Client Settings policy, not the client itself. This is akin to a Group Policy Object being linked to an OU. The machines in the collection which already have the ConfigMgr client will process those policies, but additional non-client
machines added to the collection will not automatically install the client.
As Torsten indicated, you can deploy the client to these machines using the manual client push method. Simply right click on the clients themselves (or the collection) and select Install Client. If doing it at the collection level, I recommend
against selecting "Always install the client software" in the wizard as it will force an unnecessary repair of the existing ConfigMgr clients. I would recommend testing this on one machine in the collection in question before attempting to do them in bulk.
Note that this requires that a Client Push Installation account be configured (Administration > Site Configuration > Sites > Client Installation Settings > Client Push Installation > Accounts tab) which has admin rights on the clients.
You *DO NOT need to enabled site-wide client push installation* to be able to use the Install Client method in the console. Enabling this will force the client to attempt installation on ALL systems that ConfigMgr sees.

Device filter Problems, can't burn cds in iTunes, Blank CDs appear to have

Problem was first noticed because I can't burn CDs in iTunes.
The problem is that all blank CDs show that they have no space on them available. If I look at the properties of a blank CD, they show 0 bytes used, 0 bytes free and 0 bytes available.
By removing the upperfilters and lowerfilters in the registry, (accoring to the Microsoft prescribed method for this problem found at http://support.microsoft.com/kb/314060) the problem is solved for my whole sytem except for iTunes. iTunes then tells me that "the registry settings used by iTunes drivers for importing and burning CDs and DVDs are missing. ... Please reinstall iTunes."
I reinstall or repair iTunes and then iTunes opens fine but I can't burn with iTunes or any other program since I am back to all blank CDs showing there is no space available.
The iTunes toubleshooting Fac found at http://docs.info.apple.com/article.html?artnum=302976 has been tried also and does not change the problem of blank CDs having no space available.
Here are the cd diagnostics: (Run with my whole system working except iTunes burner)
Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)
Gateway ESSEX2
iTunes 7.1.1.5
CD Driver 2.0.6.1
CD Driver DLL 2.0.6.2
Current user is an administrator.
Video Display Information:
NVIDIA GeForce4 MX 440 (Gateway)
NVIDIA GeForce FX 5200 (Gateway)
Connected Device Information:
DiskDrive, WDC WD2500JB-53EVA0, Bus Type ATA, Bus Address [0,0]
CDROM, HL-DT-ST DVDRAM GMA-4020B, Bus Type ATA, Bus Address [1,0]
CDROM, JLMS XJ-HD166S, Bus Type ATA, Bus Address [0,0]
If you have multiple drives on the same IDE or SCSI bus, these drives may interfere with each other.
Some computers need an update to the ATA or IDE bus driver, or Intel chipset. If iTunes has problems recognizing CDs or hanging or crashing while importing or burning CDs, check the support site for the manufacturer of your computer or motherboard.
Failed loading CD / DVD drives, error -43. Try doing a repair install on iTunes from the "Add or Remove Programs" control panel.
Gateway Essex2 Windows XP

Same problem here!!! This is driving me crazy. Glad to see it isn't me not knowing what I am doing when a couple of months ago I had no problems now as of last night after trying to burn to a CD I had the exact same issue.

Global device filesystem mirror between nodes.

Maybe this is an open door, but I have a question.
In a two node cluster (sc3.2) I want to have an extra disk in each node.
Then I would like to mirror them somehow, via the global filesystem.
So when one node goes down, the contents of this mirror is still available on
the other node.
Is something like this possible ? and where to look for info how to setup this ?
Kind regards,

The global file system is expected to create on shared disk if you
need high availability and accessibility from all cluster nodes.
If you have just locally attached disks, the global file system creation
doesn't provide any high availability.
If your intention is to run application (with high availability) on a
cluster with local disks, you can take iscsi approach.
-Create ZFS mirror with iscsi initiators for both targets
-Use ZFS pool for your application.
NOTE: This is not recommended for production as ZFS has some
issues(?) regarding synchronizing mirror when there are multiple failures
of nodes.
I think this configuration has been explained in open HA cluster
environments.
Thanks
-Venku

NAC - Global Device Filter in OOB deployment

Similar Messages

Maybe you are looking for