Masking a device from ESX.

There are different ways by which an administrator can hide LUNs from ESX.You can hide a device in ESX based on its path name, driver name, vendor/model or transport name.To hide a device ESX makes use of a plugin called MASK_PATH.This plugin is loaded into vmkernel by default.

Vendor Model based Device Masking.

To mask a device in ESX, based on it vendor/model you can use

~ # esxcli corestorage claimrule add -r 2000 -P MASK_PATH -t vendor -V IBM -M "1815"

~ # esxcli corestorage claimrule list

Rule Class Rule Class Type Plugin Matches

MP 2000 file vendor MASK_PATH vendor=IBM model=1815 

Masking the paths to the device.

Lets say you have devices with multiple paths and you do not want device to use some of the paths.Then you can mask the paths as follows.First find all the possible paths to the device

~ # esxcfg-mpath -b -d naa.600a0b80002a071c00006cb04a122230

naa.600a0b80002a071c00006cb04a122230 : IBM Fibre Channel Disk (naa.600a0b80002a071c00006cb04a122230)

 vmhba2:C0:T0:L22 LUN:22 state:standby fc Adapter: WWNN: 20:00:00:1b:32:10:46:c2 WWPN: 21:00:00:1b:32:10:46:c2 Target: WWNN: 20:04:00:a0:b8:26:4e:1a WWPN: 20:34:00:a0:b8:26:4e:1a

   vmhba3:C0:T1:L22 LUN:22 state:active fc Adapter: WWNN: 20:01:00:1b:32:30:46:c2 WWPN: 21:01:00:1b:32:30:46:c2 Target: WWNN: 20:04:00:a0:b8:26:4e:1a WWPN: 20:35:00:a0:b8:26:4e:1a

   vmhba3:C0:T0:L22 LUN:22 state:standby fc Adapter: WWNN: 20:01:00:1b:32:30:46:c2 WWPN: 21:01:00:1b:32:30:46:c2 Target: WWNN: 20:04:00:a0:b8:26:4e:1a WWPN: 20:34:00:a0:b8:26:4e:1a

   vmhba2:C0:T1:L22 LUN:22 state:active fc Adapter: WWNN: 20:00:00:1b:32:10:46:c2 WWPN: 21:00:00:1b:32:10:46:c2 Target: WWNN: 20:04:00:a0:b8:26:4e:1a WWPN: 20:35:00:a0:b8:26:4e:1a

Then if you want to mask a path "vmhba3:C0:T0:L22", execute following claimrule.

~ # esxcli corestorage claimrule add -r 2001 -P MASK_PATH -t location -A vmhba3 -C 0 -T 0 -L 22

~ # esxcli corestorage claimrule list

Rule Class Rule Class Type Plugin Matches

MP 2001 file location MASK_PATH adapter=vmhba3 channel=0 target=0 lun=22

Masking device based on its transport protocol.

If you want to mask a device on transport(i.e fc, sas, sata, ide ) then you can use [ I do not recommend using this, as it will mask all the devices which you may not intend to].

~ # esxcli corestorage claimrule add -r 2001 -P MASK_PATH -t transport --transport fc

~ # esxcli corestorage claimrule list

Rule Class Rule Class Type Plugin Matches

MP 2001 file transport MASK_PATH transport=fc

Masking device based on its driver.

There is also provision in ESX to mask devices that are using perticular driver.

~ # esxcli corestorage claimrule add -r 2001 -P MASK_PATH -t driver --driver qla2xxx

~ # esxcli corestorage claimrule list

Rule Class Rule Class Type Plugin Matches

MP 2001 file driver MASK_PATH driver=qla2xxx

Note: After adding the above claimrules, for the same to take effect you have to unclaim the existing claimrules that are acting upon the device. 

For unclaiming , based on the type of rule inserted run one of the unclaimrule.

~ # esxcli corestorage claiming unclaim -t vendor --vendor IBM

~ # esxcli corestorage claiming unclaim -t path --path vmhba3:C0:T0:L22

~ # esxcli corestorage claiming unclaim -t driver --driver qla2xxx

Then load and run the claimrules.

~ # esxcli corestorage claimrule load

~ # esxcli corestorage claimrule run

Note: For the new claimrules to come into effect, device should not be busy exchanging any IOs

Deleting the mask path claimrules.

Now the most important part, on deleting the claimrules.There are 'n' number of ways to add claimrules.But deleting part is the simplest one.First list the claimrules to know the rule ID.

~ # esxcli corestorage claimrule list

Rule Class Rule Class Type Plugin Matches

MP 0 runtime transport NMP transport=usb

MP 1 runtime transport NMP transport=sata

MP 2 runtime transport NMP transport=ide

MP 3 runtime transport NMP transport=block

MP 4 runtime transport NMP transport=unknown

MP 101 runtime vendor MASK_PATH vendor=DELL model=Universal Xport

MP 101 file vendor MASK_PATH vendor=DELL model=Universal Xport

MP 2001 runtime location MASK_PATH adapter=vmhba3 channel=0 target=0 lun=22

MP 2001 file location MASK_PATH adapter=vmhba3 channel=0 target=0 lun=22

MP 65535 runtime vendor NMP vendor=* model=*

Observe the highlighted rule.This was the rule added by me to mask a device path.

Delete the rule by running following esxcli commands

~ # esxcli corestorage claimrule delete -r 2001

~ # esxcli corestorage claiming unclaim -t path --path vmhba3:C0:T0:L22

~ # esxcli corestorage claimrule load

~ # esxcli corestorage claimrule run

A sample description on masking a path is also available in vmware KB article here