Sun Storage 3510 FC Array
 
Sun Storage T3 Array
 
Sun Storage 3310 Array
 
Sun Storage 6120 Array
 

GCS>Sun Microsystems>Sun Alert>Criteria Category>Availability
 
GCS>Sun Microsystems>Sun Alert>Release Phase>Resolved
 

The ethernet port and associated TCP/IP services provided by the Sun StorEdge T3/T3B/6120, Sun StorEdge 3310 and 3510 Arrays are critical to maintaining and monitoring its overall health. The TCP/IP services provided with the T3/T3B/6120, 3310 and 3510 embedded real-time operating system lack certain security features. This makes the T3/T3B/6120, 3310 and 3510 arrays vulnerable to possible network issues or deliberate attacks. Probing a T3/T3B/6120, 3310 and 3510 array's ethernet connection using network security software, has been shown , in some cases, to cause the master controller to disable. As a result, performance can decrease or data may become inaccessible.

This issue can occur in the following platforms:

• Sun StorEdge T3/T3B/6120
• StorEdge 3310 SCSI Array
• StorEdge 3510 FC Array

Note: This only occurs when any T3/T3B/6120, 3310 and 3510 array units are probed by third party network security software running a security scanner on TCP/IP ethernet port of storage array controllers.

The use of a third party network security software applications that probe Sun StorEdge T3/T3B/6120 Arrays may result in the following conditions:

A. StorEdge T3 Partner Group Configurations:

A Sun StorEdge T3/T3B/6120 and Sun StorEdge 3310 SCSI Array in a partner group configuration; the Master Controller may disable. This will cause the alternate Master Controller to perform a fail-over and it will be promoted to the master role. As long as multi-pathing software is installed and properly configured on the data host, I/O will fail-over to the remaining controller path. This could cause a performance impact due to the loss of I/O bandwidth and the Sun StorEdge T3 partner group cache mode shifting to write through for all LUNs on the partner group.

On 6120 controller with firmware 3.2.1, syslog shows data access exception:

Nov 15 14:05:12 ROOT[1]: N: 6120 Release 3.2.1 Tue Jul 19 11:21:33 PDT 2005 (10.15.3.15)
Nov 15 14:05:12 ROOT[1]: N: u1ctr Reset (2000) CPU data access exception (3)
Nov 15 14:05:12 ROOT[1]: N: CPU trap exception (2048) frame...
Nov 15 14:05:12 ROOT[1]: N: [  IP    ] 0027c66c [ LR   ] 002683e0

B. StorEdge T3 Single Array Configurations:

For Sun StorEdge T3s configured as single arrays, the controller may disable and any LUNs defined on the T3 will be inaccessible to its attached host(s) until the T3 is rebooted.

Sample error messages:

Mar 28 10:29:52 [ ... ] ISR1[2]: N: u2ctr ISP2100[1] Fatal timeout on target 0.1
Mar 28 10:29:52 [ ... ] ISR1[2]: N: u2ctr ISP2100[1] QLCF_ABORT_ALL_CMDS: Command Timeout
Pre-Gauntlet Initiated
Mar 28 10:29:52 [ ... ] ISR1[2]: N: u2ctr ISP2100[1] Received LIP(f7,e8) async event
Mar 28 10:29:59 [ ... ] HBTT[2]: N: u1ctr: Master controller failed; takeover process starts
Mar 28 10:30:00 [ ... ] IPCS[2]: N: u1ctr: Inter-controller communication failed: Receiver offline
Mar 28 10:30:02 [ ... ] ISR1[2]: N: SVD_DONE: Command Error = 0x3(lid = 19)
Mar 28 10:30:02 [ ... ] ISR1[2]: N: u2ctr mirror failed
Mar 28 10:30:02 [ ... ] ISR1[2]: N: SVD_DONE: Command Error = 0x3(lid = 19)
Mar 28 10:39:29 [ ... ] IPCS[2]: N: u2ctr Internal Command error (Aborted via time-out)

C. Sun StorEdge 3310 SCSI Array:

Should the Controller failover issue occur, messages similar to the following may be experienced:

Mon Sep  8 12:03:31 2003
[0111] #9: StorEdge Array SN#326400 Controller ALERT: redundant controller failure detected

Customers that utilize a third party network security software application that probes a T3/T3B/6120, 3310 or 3510 array can avoid the above mentioned issue by doing the following:

Connect the T3/T3B/6120, 3310 and 3510 array to a private ethernet network. A Private network is a network directly attached to a host and is not directly accessible from the public network. The private network can only be accessed by the host it is directly attached to.

The described issue can be avoided by ensuring that access to Sun StorEdge 3310 SCSI or T3/T3B/6120's administrative network is properly controlled. Do not allow network security software to probe the Sun StorEdge 3310 SCSI or StorEdge T3/T3B/6120's Ethernet port.

Please see the above Workaround section for the final resolution to this issue.

• State: Resolved
• Updated Impact, Product, BugID, Contributing Factors, Symptoms and Resolution sections

• Updated Impact

• Added Bug ID 6350194
• Updated Contributing Factors and Relief/Workaround from T3 to T3/T3B/6120

 Relief/Workaround for Sun StorEdge 3310 SCSI and Sun StorEdge 3510 FC Array : 



 To work around the described issue, provide the array with an IP address 

 that is not accessible from a publicly routeable network. 



 To work around the described issue, use the below steps to change the IP address: 



 From the <Main Menu> 



 Select  view and edit Configuration parameters and press <Return> 

 Select Communication Parameters and press <Return> 

 Select Internet Protocol (TCP/IP) and press <Return> 

 Press <Return>at the LAN0 interface prompt 

 Select Set IP address and press <Return> 

 Enter new IP address and press <Return> 

 Select NetMask and press <Return> 

 Enter new NetMask and press <Return> 

 Select Gateway and press <Return> 

 Enter new Gateway and press <Return> 





 Respond YES to Change/Set IP Address inquiry. 



 Respond YES to the below NOTICE: 



 Do you want to reset the controller now ? Yes 



 NOTE: Change made to this setting will NOT be in effect until the controller is RESET. 

 Prior to resetting the controller, operation may not proceed normally.  For best practices 

 refer to the Sun StorEdge 3000 Family Manual,Part No. 816-7325-12, dated Sept 2003, Revision A. 



 ----------- 



 Any Sun StorEdge T3 unit probed by third party network security software. Sun StorEdge T3s 

 being installed on a public network and the networking module of the pSOS operating system 

 not having the ability to handle certain types of probes against the IP address of the T3.

 

This solution has no attachment