locked
Remote management and SMB share access RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    I have a 2012 R2 Hyper-V cluster.  I have configured an EMC VNX array with SMB 3.0.  I configured the shares with full access for each of teh cluster nodes and the cluster name.  From a node of the cluster, I can select a VM, select Storage Migration, and then specify the EMC share as the destination.

    I have a Windows 8.1 management workstation from which I perform most management functions.  I want to be able to do the same thing using remote management.  From the remote cluster management console, I select a VM, select Storage Migration, but I am unable to specify the EMC share as the destination.

    I configured constrained delegation from the management workstation to the EMC array and to each of the nodes of the Hyper-V cluster, plus the cluster name itself, for cifs, just to see if that would change anything.  I also configured the EMC shares with full access for the remote workstation.  No change.

    The remote workstation does not have network access to the EMC shares.  I was hoping the constrained delegation would get me around that.  My thinking on that was that constrained delegation would allow me to use the Cluster Console and that would then request one of the nodes to make the request to the share on behalf of the workstation.  My guess is that is not how it is working.

    Question.  Is network access to the EMC array a requirement for remote management of the cluster to work?  If so, is that something that should be?  I know the cluster nodes have access to the storage.  It seems like the idea of remote management is that you are talking to the remote machines and asking them to perform something.  In this case, it seems like the management workstation has to make a connection before you can ask the cluster to perform the operation I know the cluster can perform.

    Note: I will add network access to the workstation.  It's a VM, so it won't take much to add the additional networks, but it doesn't seem like I should have to do this.

    . : | : . : | : . tim


    Monday, August 4, 2014 5:15 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    I think we posted seconds apart, I understand what you're getting at and it seems like you're correct, it's not a very sound design if it's not really remotely managing it and requires direct connections to the storage.  it would certainly show up in a netmon trace as well I would think.

    let's see what MS has to say...

    • Proposed as answer by Alex Lv Friday, August 8, 2014 2:11 AM
    • Marked as answer by Alex Lv Thursday, September 4, 2014 11:05 AM
    Tuesday, August 5, 2014 8:04 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Well, I validated my assumption.  I added additional networks that have access to the shares to my management workstation, and I am now able to manage storage migration to the EMC array.

    I understand why it is most likely working this way.  However, I think that for it to be truly 'remotely managed', I should not have to add the network to the workstation.  The workstation should talk to the cluster that is going to be performing the operation and be able to use its connections instead of using the connections available to the workstation.  In fact, I can see where the storage folks might not like the idea of providing direct access to the storage from the management workstation.  It seems like I should be able to configure constrained delegation and get this to work.

    I ran into a similar issue with SCVMM where I was unable to remotely create VMs properly.  But there configuring constrained delegation fixed the issue.  I will admit it is not a completely fair comparison because the networks in use by SCVMM were the same as those in use by my workstation.

    . : | : . : | : . tim

    • Proposed as answer by Alex Lv Friday, August 8, 2014 2:10 AM
    • Unproposed as answer by Alex Lv Friday, August 8, 2014 2:11 AM
    Tuesday, August 5, 2014 7:28 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    how is the SMB share access limited from the workstation? we're talking about different subnets/VLANs?
    Tuesday, August 5, 2014 7:29 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Initially, the workstation had no access to the SMB network.  The SMB network was a different subnet and VLAN than anything the workstation was on.  I am remotely managing the cluster, which does have access to the SMB network.  But, the cluster has full access to the network.  The Failover Cluster console is being used to initiate the action.  My point that is that since I am communicating with the cluster console to the cluster, which has access to everything needed, my workstation should not need access.  Just because it is SMB should not change how things work.  If I were asking it to move from FC LUN to FC LUN, it would work even though the workstation has no access to the FC.  Why is it different for SMB?

    . : | : . : | : . tim

    • Proposed as answer by Alex Lv Friday, August 8, 2014 2:10 AM
    • Unproposed as answer by Alex Lv Friday, August 8, 2014 2:11 AM
    Tuesday, August 5, 2014 7:56 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I think we posted seconds apart, I understand what you're getting at and it seems like you're correct, it's not a very sound design if it's not really remotely managing it and requires direct connections to the storage.  it would certainly show up in a netmon trace as well I would think.

    let's see what MS has to say...

    • Proposed as answer by Alex Lv Friday, August 8, 2014 2:11 AM
    • Marked as answer by Alex Lv Thursday, September 4, 2014 11:05 AM
    Tuesday, August 5, 2014 8:04 PM
  • Question
    Sign in to vote
    0
    Sign in to vote


    Hi,

    I would like to check if you need further assistance.

    Thanks.

    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

    Friday, August 8, 2014 2:10 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    it would be nice of MS can confirm if this is by design? I'll let Tim elaborate
    Friday, August 8, 2014 12:39 PM