LUNs, igroups, portsets and Selective LUN Map
So far your SVM has volumes, but a database server or a VMware host often doesn’t want a file share. It wants a raw disk it can format with its own file system, and that disk is a LUN.
This lesson opens Phase 2. You’ll create a LUN inside a volume, tell ONTAP which host may see it with an initiator group (igroup), and learn how portsets and Selective LUN Map decide which paths the host gets.
Where this lesson fits
Lesson 23 of 56 in NetApp ONTAP Storage Administration · Phase 2: Protocols and day-to-day administration · Before this: Lesson 22, SVM admin delegation and RBAC · Next: Lesson 24, ALUA and multipath I/O
| Time | You need | By the end you can |
|---|---|---|
| 60 minutes | The practice shell from Lesson 2 | Create a LUN, map it to the right host with an igroup, and explain which nodes report paths to it |
What it is, in one line
A LUN is a block disk that ONTAP keeps as a file inside a volume, and an igroup is the guest list of host initiators (IQNs or WWPNs) that are allowed to see it.
In Simple Words
A locker in a bank vault
Think of a bank with a big vault. Inside the vault are rows of lockers, and each locker has a number. The vault is the volume, and each locker is a LUN.
The bank doesn’t let just anyone open a locker. The manager keeps a list of names for each locker, and the guard at the door checks your ID against that list before you walk in. That list is the igroup, and your ID card is the host’s IQN or WWPN.
Some banks also say “you may only use the side door near your branch”. That’s a portset: it limits which doors (LIFs) a host can use to reach its locker.
Engineer's View
How an engineer describes it
A LUN lives in a FlexVol volume as a special file, for example /vol/vol_db1/lun_db1. Its -ostype (linux, windows, vmware, hyper_v, aix, solaris and others) sets the geometry and alignment the host expects. A LUN can be thick (space reserved) or thin (-space-reserve disabled), and the volume around it is usually thin too (-space-guarantee none).
An igroup holds initiator names for one protocol (iscsi, fcp or mixed) and one OS type. lun mapping create links a LUN to an igroup with a LUN ID; the first LUN in an igroup gets ID 0 unless you choose one. One igroup per host, or per cluster of hosts that share disks, is the safe rule.
Selective LUN Map (SLM), on by default since ONTAP 8.3, means a LUN only reports paths through the node that owns its volume and that node’s HA partner. These are the reporting nodes. A portset is an older, extra filter: bind it to an igroup and the host only sees the LUN through the LIFs in the portset.
How it works, step by step
1Make a volume to hold the LUN
Create a volume a little bigger than the LUN, often 10 to 20 percent, so snapshots and metadata have room. One LUN per volume keeps snapshots, moves and restores simple.
2Create the LUN
lun create needs the path, the size and the OS type. The LUN shows as online but unmapped, so no host can see it yet.
3Build the igroup
Collect the host’s initiator name. On Linux it’s in /etc/iscsi/initiatorname.iscsi, on Windows it’s on the Configuration tab of the iSCSI Initiator, and for FC you take the HBA WWPNs. Create the igroup with that name, the protocol and the OS type.
4Map the LUN
lun mapping create connects LUN and igroup and gives the LUN its ID. ONTAP adds the LUN’s node and its HA partner as reporting nodes, which is SLM at work.
5The host logs in and rescans
The host discovers the SVM’s iSCSI LIFs (or logs in through the FC fabric), rescans its SCSI bus, and the LUN appears as a new disk with two or more paths. The host’s multipath software joins those paths into one device, which is Lesson 24.
| Object | Command to check it | What “good” looks like |
|---|---|---|
| LUN | lun show | online, mapped |
| igroup | lun igroup show -instance | every initiator says (logged in) |
| Mapping | lun mapping show -fields reporting-nodes | the LUN’s node and its HA partner |
| Portset | lun portset show | LIFs on both nodes of the HA pair |
In System Manager the same jobs live under Storage › LUNs › + Add (it can create the volume, igroup and mapping in one go) and Hosts › SAN Initiator Groups. Portsets may not appear in every System Manager release, so use the CLI for them.
Hands-on lab: give a LUN to a Linux host over iSCSI
Before you run any command, double-check it
Read every command twice before you press Enter. Check the target: the server name, the user, the disk or device name, the path and the sizes. These commands are for learning and were tested in our lab, not on your system. At work, run the read-only commands first, follow your change process, make sure a backup exists, and ask a second person to check anything that changes or deletes data. You run them at your own risk.
This lab uses the SaatVedha ONTAP practice shell, our own learning tool. It is not NetApp software: real ONTAP output looks like this but is not identical.
1Build the starting point
In your lab folder create setup-23.txt with these six lines. They make two data aggregates, an SVM, one iSCSI LIF on each node and the iSCSI service.
storage aggregate create -aggregate aggr1_01 -node saat-cluster-01 -diskcount 8 -disktype SAS
storage aggregate create -aggregate aggr1_02 -node saat-cluster-02 -diskcount 8 -disktype SAS
vserver create -vserver svm1 -aggregate aggr1_01 -rootvolume-security-style unix
network interface create -vserver svm1 -lif svm1_iscsi1 -service-policy default-data-iscsi -home-node saat-cluster-01 -home-port e0d -address 192.168.56.131 -netmask 255.255.255.0
network interface create -vserver svm1 -lif svm1_iscsi2 -service-policy default-data-iscsi -home-node saat-cluster-02 -home-port e0d -address 192.168.56.132 -netmask 255.255.255.0
vserver iscsi create -vserver svm1Reset the lab and run the file from your terminal:
python ontapsim.py -c "simctl reset"
python ontapsim.py --run setup-23.txt✅ Checkpoint: No line in the output starts with Error.
2Check the target side
Log in (admin / saatlab1) and look at what the host will connect to.
vserver iscsi show -vserver svm1
network interface show -vserver svm1You should see this:
saat-cluster::> vserver iscsi show -vserver svm1
Vserver: svm1
Target Name: iqn.1992-08.com.netapp:sn.c84b2d40ac3f32ca940fcb7e13e6d933:vs.3
Target Alias: svm1
Administrative Status: up
saat-cluster::> network interface show -vserver svm1
Logical Status Network Current Current Is
Vserver Interface Admin/Oper Address/Mask Node Port Home
----------- ---------- ---------- ------------------ --------------- ------- ----
svm1
svm1_iscsi1
up/up 192.168.56.131/24 saat-cluster-01 e0d true
svm1_iscsi2
up/up 192.168.56.132/24 saat-cluster-02 e0d true
2 entries were displayed.The SVM has its own iSCSI target name (yours may differ) and one LIF on each node.
✅ Checkpoint: The iSCSI service is up and both LIFs are up/up.
3Create the volume and the LUN
volume create -vserver svm1 -volume vol_db1 -aggregate aggr1_01 -size 24g -space-guarantee none -snapshot-policy none
lun create -vserver svm1 -path /vol/vol_db1/lun_db1 -size 20g -ostype linux -space-reserve disabled
lun show -vserver svm1You should see this:
[Job 104] Job succeeded: Successful
Created a LUN of size 20GB (21474836480)
saat-cluster::> lun show -vserver svm1
Vserver Path State Mapped Type Size
--------- ------------------------------- ------- -------- -------- --------
svm1 /vol/vol_db1/lun_db1 online unmapped linux 20GB✅ Checkpoint: lun_db1 is online and unmapped.
4Create the igroup and map the LUN
linux1’s IQN is iqn.2004-10.com.ubuntu:01:5a7e1a2b3c4d (simctl host list shows it). On a real Ubuntu host you’d read it with sudo cat /etc/iscsi/initiatorname.iscsi.
lun igroup create -vserver svm1 -igroup ig_linux1 -protocol iscsi -ostype linux -initiator iqn.2004-10.com.ubuntu:01:5a7e1a2b3c4d
lun mapping create -vserver svm1 -path /vol/vol_db1/lun_db1 -igroup ig_linux1
lun mapping show -vserver svm1 -fields igroup,lun-id,reporting-nodesYou should see this:
vserver path igroup lun-id reporting-nodes
------- -------------------- --------- ------ -------------------------------
svm1 /vol/vol_db1/lun_db1 ig_linux1 0 saat-cluster-01,saat-cluster-02LUN ID 0, and both nodes of the HA pair report paths. On a four-node cluster you’d still see only these two nodes, because SLM leaves out the other pair.
✅ Checkpoint: The mapping shows lun-id 0 and both nodes as reporting nodes.
5Let the host log in and find the disk
The simctl host lines play linux1. Each one matches a real command, shown in simctl host help.
simctl host linux1 iscsi-discover 192.168.56.131
simctl host linux1 iscsi-login
simctl host linux1 rescan
simctl host linux1 sanlun
lun igroup show -vserver svm1 -instanceYou should see this (trimmed):
192.168.56.131:3260,1028 iqn.1992-08.com.netapp:sn.c84b2d40ac3f32ca940fcb7e13e6d933:vs.3
192.168.56.132:3260,1029 iqn.1992-08.com.netapp:sn.c84b2d40ac3f32ca940fcb7e13e6d933:vs.3
Login to [iface: default, target: iqn.1992-08.com.netapp:sn.c84b2d40ac3f32ca940fcb7e13e6d933:vs.3, portal: 192.168.56.131,3260] successful.
Login to [iface: default, target: iqn.1992-08.com.netapp:sn.c84b2d40ac3f32ca940fcb7e13e6d933:vs.3, portal: 192.168.56.132,3260] successful.
Scanning SCSI subsystem for new devices... 2 new or changed device(s) found.
ONTAP Path: svm1:/vol/vol_db1/lun_db1
LUN: 0
LUN Size: 20GB
...
up primary sdb host30 svm1_iscsi1
up secondary sdc host31 svm1_iscsi2
saat-cluster::> lun igroup show -vserver svm1 -instance
Vserver Name: svm1
Igroup Name: ig_linux1
Protocol: iscsi
OS Type: linux
Portset Binding Igroup: -
Igroup UUID: 9cb5f1f0-3cfe-5eb6-6aab-dd1205720888
Initiators: iqn.2004-10.com.ubuntu:01:5a7e1a2b3c4d (logged in)Discovery from one LIF returned both portals, the host logged in to both, and one LUN came back as two paths. The primary path goes through node 01, which owns aggr1_01; the secondary goes through the partner.
✅ Checkpoint: sanlun shows one primary and one secondary path, and the initiator says (logged in).
6Add a portset
lun portset create -vserver svm1 -portset ps_db -protocol iscsi -port-name svm1_iscsi1,svm1_iscsi2
lun igroup bind -vserver svm1 -igroup ig_linux1 -portset ps_db
lun portset show -vserver svm1You should see this:
Vserver Portset Protocol Port Names Igroups
---------- ------------ -------- -------------------- ------------
svm1_iscsi1, svm1_iscsi2
svm1 ps_db iscsi ig_linux1With only two LIFs this changes nothing, but on a cluster with eight iSCSI LIFs a portset keeps a host down to the four or so paths it really needs. Always keep LIFs from both nodes of the HA pair in a portset.
✅ Checkpoint: ps_db lists both LIFs and ig_linux1.
Try it yourself: Build the full iSCSI LUN commands in the Command Builder.
Break It, Then Fix It
The most common SAN ticket of all: “I can’t see the disk”. Here you cause it with one wrong character.
1Map a LUN to an igroup with a typo
rhel1’s real IQN ends in 9a7e. Type it with 9a7f:
volume create -vserver svm1 -volume vol_app2 -aggregate aggr1_02 -size 12g -space-guarantee none -snapshot-policy none
lun create -vserver svm1 -path /vol/vol_app2/lun_app2 -size 10g -ostype linux -space-reserve disabled
lun igroup create -vserver svm1 -igroup ig_rhel1 -protocol iscsi -ostype linux -initiator iqn.1994-05.com.redhat:8f3d2c1b9a7f
lun mapping create -vserver svm1 -path /vol/vol_app2/lun_app2 -igroup ig_rhel1
simctl host rhel1 iscsi-discover 192.168.56.132
simctl host rhel1 iscsi-login
simctl host rhel1 rescanThe last line gives you this:
Scanning SCSI subsystem for new devices... 0 new or changed device(s) found.
(No LUN paths. Check: sessions or FC logins, igroup initiators, LUN mapping, LUN/volume online, reporting nodes.)The host logged in fine, so the network is good. ONTAP simply doesn’t find that host’s name on the LUN’s guest list.
2Find the mismatch
lun igroup show -vserver svm1 -igroup ig_rhel1 -fields initiator
vserver iscsi initiator show -vserver svm1You should see this:
vserver igroup initiator
------- -------- -----------------------------------
svm1 ig_rhel1 iqn.1994-05.com.redhat:8f3d2c1b9a7f
saat-cluster::> vserver iscsi initiator show -vserver svm1
Tpgroup Initiator Igroup
Vserver Name Name Name
---------- ------------- ---------------------------------------------- ------------
svm1 svm1_iscsi1 iqn.2004-10.com.ubuntu:01:5a7e1a2b3c4d ig_linux1
svm1 svm1_iscsi2 iqn.2004-10.com.ubuntu:01:5a7e1a2b3c4d ig_linux1
svm1 svm1_iscsi1 iqn.1994-05.com.redhat:8f3d2c1b9a7e -
svm1 svm1_iscsi2 iqn.1994-05.com.redhat:8f3d2c1b9a7e -
4 entries were displayed.The logged-in rhel1 initiator has a dash in the Igroup column: it belongs to no igroup. Compare the two names character by character and the 9a7f stands out.
3Fix it and rescan
lun igroup remove -vserver svm1 -igroup ig_rhel1 -initiator iqn.1994-05.com.redhat:8f3d2c1b9a7f
lun igroup add -vserver svm1 -igroup ig_rhel1 -initiator iqn.1994-05.com.redhat:8f3d2c1b9a7e
simctl host rhel1 rescanYou should see this:
Scanning SCSI subsystem for new devices... 2 new or changed device(s) found.✅ Checkpoint: rhel1 finds two paths after the fix.
Copy initiator names from vserver iscsi initiator show or from the host itself, never by retyping. While you’re here, try lun delete -vserver svm1 -path /vol/vol_db1/lun_db1: ONTAP refuses because the LUN is still mapped, which is a safety net worth knowing.
This happened at work
The igroup everybody shared
A private hospital in Kolkata kept its scan images on an ONTAP cluster. Years before, someone had made one igroup called ig_servers and put every SAN host into it: the ESXi cluster, two Windows file servers and a backup media server. It saved a few minutes each time a new LUN was needed.
One Tuesday a new 2 TB LUN for the ESXi cluster was mapped to ig_servers as usual. A Windows admin saw a fresh disk in Disk Management on one of the file servers, thought it was the space he had asked for, and clicked Initialize. Within minutes the new VMware datastore on that LUN showed as inaccessible.
Luckily no VMs had moved there yet, so they deleted and recreated the datastore. The team then split ig_servers into one igroup per host or per cluster, checked every mapping against the change records, and added a rule: a new LUN is mapped only to the igroup named in the request.
Common mistakes and troubleshooting
| Mistake | What happens | Do this instead |
|---|---|---|
| One igroup for many unrelated hosts | Hosts see each other’s LUNs and one can overwrite another’s data | One igroup per host, or per cluster that shares disks |
| Typing an IQN or WWPN by hand | The host logs in but never sees the LUN | Copy it from vserver iscsi initiator show, the switch or the host |
| Wrong -ostype on the LUN or igroup | Poor alignment or odd behaviour on the host | Match the host OS; for ESXi use vmware |
| Volume the same size as the LUN | Snapshots have no room and the volume fills | Make the volume 10 to 20 percent bigger, or turn on autosize |
| Moving a LUN volume to another HA pair without reporting nodes | Host loses its optimized paths | Run lun mapping add-reporting-nodes before the move, remove the old ones after |
| Deleting a LUN the host still uses | The host sees I/O errors on a disk that vanished | Ask the host team to remove the disk first, unmap, offline, wait, then delete |
Interview questions
Click a question to open it. Each one is written the way an interviewer would ask it. Under it you will see why they ask it and one way you could answer, in your own words.
Fresher level
1. Can you explain in simple words what a LUN and an igroup are in ONTAP?
Why they ask this: They want to check you understand the two basic SAN objects and how they relate.
How you might answer: A LUN is a block disk that ONTAP stores inside a volume. The host formats it like a local disk. An igroup is the list of host initiator names, IQNs for iSCSI or WWPNs for FC, that are allowed to see the LUNs mapped to it.
2. A Linux admin says the new LUN isn’t showing up. What would you check first on the storage side?
Why they ask this: They’re checking whether you have a simple, ordered way to look at the problem.
How you might answer: I’d run lun show to make sure it’s online and mapped, then lun igroup show -instance to see if the host’s initiator says logged in. If it says not logged in, I’d compare the IQN with vserver iscsi initiator show, because a typo there is the most common cause.
2–5 years experience
3. What is Selective LUN Map and why does it matter?
Why they ask this: They want to know you understand how ONTAP limits paths on bigger clusters.
How you might answer: With SLM a LUN only reports paths through the node that owns it and that node’s HA partner. On an eight-node cluster that keeps hosts from seeing dozens of useless paths.
It matters when you move a LUN’s volume to another HA pair: I add the new nodes with lun mapping add-reporting-nodes before the move, then remove the old ones afterwards.
4. When would you still use a portset?
Why they ask this: They’re testing whether you know an older feature and when it still helps.
How you might answer: I’d use one when an SVM has many iSCSI or FC LIFs and I want a host to use only some of them, for example two LIFs per node on one VLAN. I bind the portset to the igroup and always keep LIFs from both nodes of the HA pair in it, or the host loses its failover path.
Senior level
5. How would you design igroups for a 16-host ESXi cluster and a few standalone Windows servers?
Why they ask this: They want to see that you think about safety and day-to-day operations, not only the first build.
How you might answer: The ESXi cluster gets one igroup with all 16 hosts’ initiators and ostype vmware, because every host must see every datastore. Each Windows server gets its own igroup with ostype windows.
I name them clearly, like ig_esx_prod and ig_win_sql01, and I never map a LUN to two unrelated igroups unless it’s a planned cluster disk.
6. You need to decommission a database server with six LUNs. How do you do it safely?
Why they ask this: They’re checking risk control and how you work with other teams.
How you might answer: First I’d confirm in writing with the owner and make sure the host team has removed the disks from the OS and multipath. Then I’d take a last snapshot, delete the mappings, take the LUNs offline and leave them for an agreed time, say a week.
Only after that I’d delete the LUNs and the igroup, and update the records.
Quick quiz
Q1. Where does an ONTAP LUN live?
- Directly on an aggregate
- Inside a FlexVol volume
- On a LIF
- In the igroup
Show answer
B — a LUN is stored inside a volume, for example /vol/vol_db1/lun_db1.
Q2. What does an igroup hold?
- LUN sizes
- Host initiator names (IQNs or WWPNs)
- Snapshot schedules
- Aggregate names
Show answer
B — an igroup is the list of host initiators allowed to see the mapped LUNs.
Q3. With Selective LUN Map, which nodes report paths to a LUN by default?
- Every node in the cluster
- Only the node that owns the LUN
- The owning node and its HA partner
- Only the cluster management node
Show answer
C — SLM reports paths through the owning node and its HA partner.
Q4. The host logged in over iSCSI but sees no disk, and vserver iscsi initiator show lists its IQN with a dash for igroup. What’s wrong?
- The LIF is down
- The IQN in the igroup doesn’t match the host
- The LUN is too big
- NFS is not enabled
Show answer
B — a dash means the logged-in initiator belongs to no igroup, so the igroup holds a different name.
Q5. Why does lun delete fail with “is mapped to igroup(s)”?
- The LUN is offline
- ONTAP won’t delete a LUN that is still mapped
- The volume is full
- You need advanced privilege
Show answer
B — you must remove the mapping first, which protects LUNs that hosts still use.
Quick recap
- A LUN is a block disk stored inside a volume; give the volume some extra room.
- An igroup is the guest list: one protocol, one OS type, the host’s IQNs or WWPNs.
- lun mapping create links them and sets the LUN ID.
- SLM reports paths only through the owning node and its HA partner; portsets can narrow LIFs further.
- “Can’t see the disk” usually means a wrong initiator name: compare with vserver iscsi initiator show.
Next lesson
Lesson 24: ALUA and multipath I/O → You’ll see why one path is optimized and the other isn’t, and watch multipath move I/O when a path fails.
Further reading: ONTAP LUN
Want to go deeper into ONTAP LUN? Read NetApp’s ONTAP concepts guide for how SAN, volumes and LUNs fit together, then try the iSCSI LUN task in the Command Builder. You can also see the full plan for this course on the NetApp ONTAP Storage Administration course page.