iSCSI and multipath on Linux

Step 1 runs on the laptop with both VMs shut down. Steps 2 to 4 set up the network and the target, and from step 5 on you work on rocky01. Remember that rocky01 already has three local 5 GB disks (sdb, sdc and sdd from Lessons 42 to 45), so the iSCSI disks arrive as sde and sdf; read your own names from the output.

1Add the storage network to both VMs

Shut down both VMs, then run this on the laptop (PowerShell or a terminal):

VBoxManage modifyvm rocky01 --nic2=intnet --intnet2=storage --nic-type2=82540EM
VBoxManage modifyvm ubu01 --nic2=intnet --intnet2=storage --nic-type2=82540EM
VBoxManage showvminfo rocky01 --machinereadable | grep -E '^(nic2|intnet2)='

You should see something like this:

nic2="intnet"
intnet2="storage"

An Internal Network is a private switch inside VirtualBox that only the VMs plugged into it can see, with no DHCP and no way out. On Windows, replace the grep with findstr /B "nic2= intnet2=". Adapter 2 shows up in Linux as enp0s8.

Start both VMs again.

✅ Checkpoint: showvminfo shows nic2 as intnet on the network “storage” for rocky01 (check ubu01 the same way).

2Give each VM an address on 10.10.20.0/24

On rocky01:

sudo nmcli connection add type ethernet con-name storage ifname enp0s8 ipv4.method manual ipv4.addresses 10.10.20.11/24 ipv6.method disabled
sudo nmcli connection up storage
ip -br addr show enp0s8

You should see something like this:

Connection 'storage' (6f0b3e2a-9c41-4d8e-b5a7-2e1c9d4f8a63) successfully added.
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/6)
enp0s8           UP             10.10.20.11/24

If nmcli connection show also lists a “Wired connection 1” on enp0s8, delete it with sudo nmcli connection delete "Wired connection 1", as in Lesson 31. No gateway on this profile: the storage network is a dead end on purpose.

On ubu01, paste this whole block:

sudo tee /etc/netplan/60-storage.yaml >/dev/null <<'EOF'
network:
  version: 2
  ethernets:
    enp0s8:
      dhcp4: false
      addresses:
        - 10.10.20.21/24
EOF
sudo chmod 600 /etc/netplan/60-storage.yaml
sudo netplan apply
ip -br addr show enp0s8

enp0s8           UP             10.10.20.21/24 fe80::a00:27ff:fe5c:1e2a/64

Then test from rocky01:

ping -c 2 10.10.20.21

PING 10.10.20.21 (10.10.20.21) 56(84) bytes of data.
64 bytes from 10.10.20.21: icmp_seq=1 ttl=64 time=0.612 ms
64 bytes from 10.10.20.21: icmp_seq=2 ttl=64 time=0.498 ms

--- 10.10.20.21 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 0.498/0.555/0.612/0.057 ms

✅ Checkpoint: rocky01 reaches ubu01 on 10.10.20.21 through enp0s8.

3Build the target with targetcli

Paste this whole block on ubu01:

sudo apt install -y targetcli-fb
sudo mkdir -p /srv/iscsi
sudo targetcli /backstores/fileio create name=lun0 file_or_dev=/srv/iscsi/lun0.img size=2G
sudo targetcli /iscsi create iqn.2026-10.test.saatlab:ubu01.lun0
sudo targetcli /iscsi/iqn.2026-10.test.saatlab:ubu01.lun0/tpg1/luns create /backstores/fileio/lun0
sudo targetcli /iscsi/iqn.2026-10.test.saatlab:ubu01.lun0/tpg1/acls create iqn.2026-10.test.saatlab:rocky01
sudo targetcli /iscsi/iqn.2026-10.test.saatlab:ubu01.lun0/tpg1/portals delete 0.0.0.0 3260
sudo targetcli /iscsi/iqn.2026-10.test.saatlab:ubu01.lun0/tpg1/portals create 10.10.10.21 3260
sudo targetcli /iscsi/iqn.2026-10.test.saatlab:ubu01.lun0/tpg1/portals create 10.10.20.21 3260
sudo targetcli saveconfig

After the apt lines you should see something like this:

Created fileio lun0 with size 2147483648
Created target iqn.2026-10.test.saatlab:ubu01.lun0.
Created TPG 1.
Global pref auto_add_default_portal=true
Created default portal listening on all IPs (0.0.0.0), port 3260.
Created LUN 0.
Created Node ACL for iqn.2026-10.test.saatlab:rocky01
Created mapped LUN 0.
Deleted network portal 0.0.0.0:3260
Using default IP port 3260
Created network portal 10.10.10.21:3260.
Using default IP port 3260
Created network portal 10.10.20.21:3260.
Configuration saved to /etc/rtslib-fb-target/saveconfig.json

Each line builds one object from the diagram: the 2 GiB file (sparse, so it uses almost no space until rocky01 writes), the target and its portal group, LUN 0, the ACL (which picked up LUN 0 automatically), and two portals in place of the default one that listens on every address. Run as one-line commands like this, targetcli does not save on exit, so the last line matters.

✅ Checkpoint: The output ends with “Configuration saved to” and names both portals.

4Check the tree and open port 3260

Run this on ubu01:

sudo targetcli ls
sudo ufw allow from 10.10.10.11 to any port 3260 proto tcp
sudo ufw allow from 10.10.20.11 to any port 3260 proto tcp
sudo ufw status numbered

You should see something like this:

o- / ............................................................................. [...]
  o- backstores .................................................................. [...]
  | o- block ...................................................... [Storage Objects: 0]
  | o- fileio ..................................................... [Storage Objects: 1]
  | | o- lun0 ...................... [/srv/iscsi/lun0.img (2.0GiB) write-back activated]
  | |   o- alua ....................................................... [ALUA Groups: 1]
  | |     o- default_tg_pt_gp ........................... [ALUA state: Active/optimized]
  | o- pscsi ...................................................... [Storage Objects: 0]
  | o- ramdisk .................................................... [Storage Objects: 0]
  o- iscsi ................................................................ [Targets: 1]
  | o- iqn.2026-10.test.saatlab:ubu01.lun0 ................................... [TPGs: 1]
  |   o- tpg1 ................................................... [no-gen-acls, no-auth]
  |     o- acls .............................................................. [ACLs: 1]
  |     | o- iqn.2026-10.test.saatlab:rocky01 ......................... [Mapped LUNs: 1]
  |     |   o- mapped_lun0 ..................................... [lun0 fileio/lun0 (rw)]
  |     o- luns .............................................................. [LUNs: 1]
  |     | o- lun0 ............... [fileio/lun0 (/srv/iscsi/lun0.img) (default_tg_pt_gp)]
  |     o- portals ........................................................ [Portals: 2]
  |       o- 10.10.10.21:3260 ..................................................... [OK]
  |       o- 10.10.20.21:3260 ..................................................... [OK]
  o- loopback ............................................................. [Targets: 0]
  o- vhost ................................................................ [Targets: 0]
  o- xen-pvscsi ........................................................... [Targets: 0]

Rule added
Rule added
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] OpenSSH                    ALLOW IN    Anywhere
[ 2] 514/tcp                    ALLOW IN    10.10.10.11
[ 3] 2049/tcp                   ALLOW IN    10.10.10.0/24
[ 4] 3260/tcp                   ALLOW IN    10.10.10.11
[ 5] 3260/tcp                   ALLOW IN    10.10.20.11
[ 6] OpenSSH (v6)               ALLOW IN    Anywhere (v6)

Read the tree from the top: one fileio object, one target, an ACL for rocky01 with one mapped LUN, and two portals marked OK. ufw allows 3260 only from rocky01’s two addresses, one rule per path, next to the NFS rule from Lesson 47.

✅ Checkpoint: targetcli ls shows ACLs: 1, LUNs: 1, Portals: 2, and ufw has two 3260/tcp rules.

5Name the initiator and discover the target

Run this on rocky01:

sudo dnf install -y iscsi-initiator-utils device-mapper-multipath
echo 'InitiatorName=iqn.2026-10.test.saatlab:rocky01' | sudo tee /etc/iscsi/initiatorname.iscsi
sudo systemctl restart iscsid
systemctl is-active iscsid
sudo iscsiadm -m discovery -t sendtargets -p 10.10.10.21

You should see something like this:

InitiatorName=iqn.2026-10.test.saatlab:rocky01
active
10.10.10.21:3260,1 iqn.2026-10.test.saatlab:ubu01.lun0
10.10.20.21:3260,1 iqn.2026-10.test.saatlab:ubu01.lun0

The package wrote a random IQN into initiatorname.iscsi; you replace it with the one the ACL expects, and iscsid only reads the file when it starts. Discovery through one portal returned both, so iscsiadm now has two node records for the same target.

✅ Checkpoint: Discovery lists the target on 10.10.10.21 and on 10.10.20.21.

6Log in on both paths

Run this on rocky01:

sudo iscsiadm -m node -T iqn.2026-10.test.saatlab:ubu01.lun0 --login
sudo iscsiadm -m session
lsblk -o NAME,SIZE,TYPE,TRAN,VENDOR,MODEL /dev/sde /dev/sdf
sudo /usr/lib/udev/scsi_id -g -u -d /dev/sde
sudo /usr/lib/udev/scsi_id -g -u -d /dev/sdf

You should see something like this:

Logging in to [iface: default, target: iqn.2026-10.test.saatlab:ubu01.lun0, portal: 10.10.10.21,3260] (multiple)
Logging in to [iface: default, target: iqn.2026-10.test.saatlab:ubu01.lun0, portal: 10.10.20.21,3260] (multiple)
Login to [iface: default, target: iqn.2026-10.test.saatlab:ubu01.lun0, portal: 10.10.10.21,3260] successful.
Login to [iface: default, target: iqn.2026-10.test.saatlab:ubu01.lun0, portal: 10.10.20.21,3260] successful.
tcp: [1] 10.10.10.21:3260,1 iqn.2026-10.test.saatlab:ubu01.lun0 (non-flash)
tcp: [2] 10.10.20.21:3260,1 iqn.2026-10.test.saatlab:ubu01.lun0 (non-flash)
NAME SIZE TYPE TRAN  VENDOR  MODEL
sde    2G disk iscsi LIO-ORG lun0
sdf    2G disk iscsi LIO-ORG lun0
36001405a91c4e2b7d3f84c6e5b0d2f17
36001405a91c4e2b7d3f84c6e5b0d2f17

Two sessions, two disks, and both report the same WWID: 3, then 6001405 (LIO’s vendor prefix), then the LUN’s serial. Right now nothing stops a program from writing to sde and another from writing to sdf, each thinking it owns a separate disk. That is why the next step comes before any mkfs.

✅ Checkpoint: sde and sdf are both 2G LIO-ORG lun0 disks and scsi_id prints the same WWID for both.

7Turn on multipath

Run this on rocky01:

sudo mpathconf --enable --with_multipathd y
grep -v '^#' /etc/multipath.conf | grep -v '^$'
sudo multipath -ll

You should see something like this:

defaults {
	user_friendly_names yes
	find_multipaths yes
	enable_foreign "^$"
}
blacklist_exceptions {
        property "(SCSI_IDENT_|ID_WWN)"
}
mpatha (36001405a91c4e2b7d3f84c6e5b0d2f17) dm-4 LIO-ORG,lun0
size=2.0G features='1 queue_if_no_path' hwhandler='1 alua' wp=rw
`-+- policy='service-time 0' prio=50 status=active
  |- 6:0:0:0 sde 8:64 active ready running
  `- 7:0:0:0 sdf 8:80 active ready running

mpathconf wrote a small multipath.conf and started multipathd, which found two paths with one WWID and built mpatha on dm-4. Read the second line: hwhandler='1 alua' and queue_if_no_path come from the built-in settings for LIO-ORG. Both paths sit in one group with priority 50 (ALUA active/optimized), so I/O uses both.

The local disks sdb to sdd have one path each, and find_multipaths yes leaves them alone.

Now see how the pieces fit:

lsblk -o NAME,SIZE,TYPE /dev/sde /dev/sdf
grep -v '^#' /etc/multipath/bindings

NAME     SIZE TYPE
sde        2G disk
└─mpatha   2G mpath
sdf        2G disk
└─mpatha   2G mpath
mpatha 36001405a91c4e2b7d3f84c6e5b0d2f17

✅ Checkpoint: multipath -ll shows mpatha with sde and sdf both “active ready running”.

8Make a file system on the multipath device

Run this on rocky01:

sudo mkfs.xfs -q /dev/mapper/mpatha
sudo mkdir -p /mnt/iscsi
sudo mount /dev/mapper/mpatha /mnt/iscsi
echo "written while both paths were up" | sudo tee /mnt/iscsi/hello.txt >/dev/null
df -h /mnt/iscsi
cat /mnt/iscsi/hello.txt

You should see something like this:

Filesystem          Size  Used Avail Use% Mounted on
/dev/mapper/mpatha  2.0G   79M  1.9G   4% /mnt/iscsi
written while both paths were up

The file system lives on the LUN, and you reach it only through /dev/mapper/mpatha. For a permanent mount you would add /dev/mapper/mpatha /mnt/iscsi xfs _netdev,nofail 0 0 to fstab; this lab leaves it out so rocky01 boots cleanly when ubu01 is off.

✅ Checkpoint: df shows /dev/mapper/mpatha mounted on /mnt/iscsi.

9Pull one path while you write

Run this on rocky01:

sudo nmcli connection down storage
sleep 15
sudo multipath -ll

You should see something like this:

mpatha (36001405a91c4e2b7d3f84c6e5b0d2f17) dm-4 LIO-ORG,lun0
size=2.0G features='1 queue_if_no_path' hwhandler='1 alua' wp=rw
`-+- policy='service-time 0' prio=50 status=active
  |- 6:0:0:0 sde 8:64 active ready running
  `- 7:0:0:0 sdf 8:80 failed faulty running

The storage path is gone and multipathd marked sdf “failed faulty”. Now prove the disk still works, and read what the kernel said:

sudo dd if=/dev/zero of=/mnt/iscsi/test.bin bs=1M count=100 oflag=direct status=none
ls -lh /mnt/iscsi/test.bin
sudo journalctl -b --since "5 min ago" --no-pager | grep -E 'recovery timed out|Failing path|remaining active'

-rw-r--r--. 1 root root 100M Oct 27 12:31 /mnt/iscsi/test.bin
Oct 27 12:30:41 rocky01 kernel: session2: session recovery timed out after 5 secs
Oct 27 12:30:41 rocky01 kernel: device-mapper: multipath: 253:4: Failing path 8:80.
Oct 27 12:30:41 rocky01 multipathd[2391]: mpatha: remaining active paths: 1

Five seconds after the link dropped, the iSCSI session gave up recovering, device-mapper failed path 8:80 (sdf) and the 100 MB write went down sde. Bring the path back and give iscsid a few seconds to log in again:

sudo nmcli connection up storage
sleep 20
sudo multipath -ll

✅ Checkpoint: After the path returns, multipath -ll shows both sde and sdf “active ready running” again, and test.bin is 100M.

10Where FC WWPNs live

Run this on rocky01:

ls /sys/class/fc_host
cat /sys/class/iscsi_session/session*/targetname
cat /sys/class/iscsi_session/session1/initiatorname

You should see something like this:

ls: cannot access '/sys/class/fc_host': No such file or directory
iqn.2026-10.test.saatlab:ubu01.lun0
iqn.2026-10.test.saatlab:ubu01.lun0
iqn.2026-10.test.saatlab:rocky01

VirtualBox has no Fibre Channel HBAs, so the fc_host class doesn’t exist on rocky01. The iSCSI sessions keep their names in the same kind of sysfs folder. On a real server with two FC ports, the storage team asks for the WWPNs, and you read them like this:

cat /sys/class/fc_host/host*/port_name
cat /sys/class/fc_host/host*/port_state

On a server with a dual-port FC HBA you’d see something like:

0x10000090fa8b2c4e
0x10000090fa8b2c4f
Online
Online

Give the WWPNs with the colons the storage team expects (10:00:00:90:fa:8b:2c:4e). After they zone and mask a new LUN, you scan for it as in Lesson 45 (echo "- - -" | sudo tee /sys/class/scsi_host/hostN/scan) and check multipath -ll before using it.

✅ Checkpoint: You can say which file holds a WWPN and what the storage team does with it.

11Leave it tidy

Run this on rocky01:

sudo umount /mnt/iscsi
sudo iscsiadm -m node -T iqn.2026-10.test.saatlab:ubu01.lun0 --logout
sudo iscsiadm -m node -T iqn.2026-10.test.saatlab:ubu01.lun0 -o update -n node.startup -v manual
sudo multipath -ll

You should see something like this (and nothing from multipath -ll):

Logging out of session [sid: 1, target: iqn.2026-10.test.saatlab:ubu01.lun0, portal: 10.10.10.21,3260]
Logging out of session [sid: 2, target: iqn.2026-10.test.saatlab:ubu01.lun0, portal: 10.10.20.21,3260]
Logout of [sid: 1, target: iqn.2026-10.test.saatlab:ubu01.lun0, portal: 10.10.10.21,3260] successful.
Logout of [sid: 2, target: iqn.2026-10.test.saatlab:ubu01.lun0, portal: 10.10.20.21,3260] successful.

The LUN keeps its XFS file system and files on ubu01. The node records stay on rocky01 but no longer log in at boot, so rocky01 starts normally when ubu01 is off. To use the disk again: sudo iscsiadm -m node -T iqn.2026-10.test.saatlab:ubu01.lun0 --login, then mount /dev/mapper/mpatha.

✅ Checkpoint: No iSCSI sessions are left (iscsiadm -m session says “No active sessions”) and multipath -ll prints nothing.