DB-유

Synology iSCSI Targets for VMware and Windows

· synology, iscsi, vmware

NFS and SMB shares are fine until a hypervisor or a Windows workload demands a real block device it can format and treat as local. That's where I turn to iSCSI. DSM 6.2 moved the feature into its own iSCSI Manager package, with thin-provisioned LUNs, Btrfs snapshots and VAAI for VMware. Below I create a LUN and connect it from an ESXi 6.7 host and from Windows Server 2016.

I assume iSCSI Manager is installed (it comes with DSM 6.2 on supported models). A dedicated network or VLAN for storage traffic is ideal, and use a Btrfs volume if you want advanced LUNs with snapshots and instant clone; ext4 gives you only the older file-based LUN.

1. Create the LUN

iSCSI Manager → LUN → Create:

Name:            vmware-lun1
Location:        Volume 1 (Btrfs)
Total capacity:  2000 GB
Space allocation: Thin provisioning
Advanced features: enable Hardware-assisted zeroing, locking, data transfer (VAAI)

Thin provisioning lets you present 2 TB while using only what the guests write, but you must watch the volume's free space. Running out is much worse for a block device than for a share, and I check it more often than I'd like to admit.

2. Target and CHAP

iSCSI Manager → Target → Create:

Name:      esxi-target
IQN:       iqn.2000-01.com.synology:diskstation.esxi-target
CHAP:      enabled, user esxi, 12–16 character password
Map LUN:   vmware-lun1

Under the target's Edit → Advanced tick "Allow multiple sessions" only for cluster-aware file systems such as VMFS; for a Windows NTFS LUN it must stay off, or two hosts will corrupt it. Masking lets you restrict which initiator IQNs may connect; I add the ESXi and Windows IQNs there rather than leaving it open to the subnet.

3. Connect from VMware ESXi

In the vSphere client (host UI or vCenter): Host → Configure → Storage Adapters → iSCSI Software Adapter → enable if needed. Then:

  1. Dynamic Discovery → Add: the NAS storage IP, port 3260.
  2. Authentication → use unidirectional CHAP with the name and secret from the target step.
  3. Network Port Binding → add the VMkernel port on the storage VLAN.
  4. Rescan Storage.

Then Datastores → New Datastore → VMFS 6 → select the Synology LUN. From the ESXi shell you can check the path:

esxcli iscsi adapter discovery sendtarget list
esxcli storage core path list | grep -A5 SYNOLOGY

With VAAI active, esxcli storage core device vaai status get shows Zero Status: supported and ATS Status: supported for the device.

4. Connect from Windows Server

Run iSCSI Initiator (iscsicpl.exe), click Yes to start the service, and on the Discovery tab add the NAS portal. On Targets, select the target, click Connect → Advanced → tick Enable CHAP log on and enter the credentials. Tick Add this connection to the list of Favorite Targets so it reconnects at boot. In PowerShell the same is:

Set-Service MSiSCSI -StartupType Automatic; Start-Service MSiSCSI
New-IscsiTargetPortal -TargetPortalAddress 192.168.50.20
Connect-IscsiTarget -NodeAddress iqn.2000-01.com.synology:diskstation.win-target `
  -IsPersistent $true -AuthenticationType ONEWAYCHAP -ChapUsername win -ChapSecret 'longsecret123'

Then Disk Management shows a new offline disk: bring it online, initialize GPT, create a volume and format NTFS.

5. Multipath (optional)

If the NAS has two storage interfaces, add both portals. On ESXi, path selection policy Round Robin on the device gives real load sharing. On Windows, install the Multipath I/O feature (Install-WindowsFeature Multipath-IO), enable it for iSCSI in mpiocpl.exe, reboot, and connect twice with "Enable multi-path" ticked. Do not use a bond for iSCSI; MPIO does the balancing better.

Confirm the sessions

iSCSI Manager → Target shows the target as Connected with the initiator IQN and IP. On the NAS:

sudo synoiscsiep --list 2>/dev/null || sudo cat /proc/net/iet/session

Fill the datastore with a test VM and check Resource Monitor → Disk; iSCSI traffic appears as writes on the volume. On a Btrfs LUN you can take a snapshot under iSCSI Manager → Snapshot, then clone it to a new LUN to test restore without touching the original.

Known problems

  • ESXi finds no device after rescan: CHAP secret mismatch or the initiator IQN is not in the masking list. The iSCSI Manager log (iSCSI Manager → Log) shows Authentication failed for initiator iqn....
  • Windows connects but the disk stays "Offline (The disk is offline because of policy set by an administrator)": run Set-Disk -Number N -IsOffline $false, or change the SAN policy with diskpart → san policy=OnlineAll.
  • Datastore becomes inaccessible during heavy load and the vmkernel log shows iSCSI connection is being marked "OFFLINE": jumbo frames are mismatched somewhere on the path. Set MTU 1500 everywhere, then re-enable 9000 only when every hop is confirmed.
  • Volume shows 100 percent used while the LUN reports free space: thin LUN grew and deleted guest data was never reclaimed. Run esxcli storage vmfs unmap -l datastore1 on ESXi; Windows sends UNMAP automatically with Optimize-Volume -ReTrim.

Good enough for a small vSphere lab. I wouldn't put anything critical on it without a second copy of the LUN somewhere.