Virtual Fibre Channel Best Practices

Configure Virtual SAN and Virtual Fibre Channel in Hyper-V for FlashArray

FlashArray can not only be accessed directly by a Hyper-V host for its storage, but also from virtual machines (VMs). Doing this allows a VM to access the full complement of features and benefits such as volume snapshots in FlashArray if they are needed at a guest level.

There are two ways to achieve direct access to FlashArray from a VM in Hyper-V: use iSCSI or use the virtual fiber channel capabilities built into Hyper-V. To configure this, there are two tasks: configure the Virtual SAN at the host layer and then ensure that the VM has the proper configuration. The next section will cover how to configure Virtual SAN and then how to use virtual host bus adapters (HBAs) with VMs in Hyper-V.

For more information, read Microsoft’s official documentation linked below:

Hyper-V Virtual Fibre Channel in Windows Server | Microsoft Learn

Implement Hyper-V Virtual Fibre Channel | Microsoft Learn

Configure Virtual Lan

The instructions below show how to configure Virtual SAN on a Hyper-V host. This must be done on every host even if it is part of a Windows Server Failover Cluster (WSFC) as the settings are not universal. A Virtual SAN must be configured before host bus adapters (HBAs) can be added to a VM. If Virtual SAN is not configured on each host, VM migrations will fail.

Before doing anything else, on the hypervisor host, run the command Get-InitiatorPort | Where {$_.ConnectionType -eq "Fibre Channel"} to see the addresses of the fibre channel ports on the Hyper-V. There are two types of addresses: node and port. Hyper-V cares about both while FlashArray only cares about ports. Example output is shown below.

Configure Hyper-V – GUI Method

On the Windows Server host running Hyper-V, start Hyper-V Manager.
Select Virtual SAN Manager as shown.
Under Create Virtual Fibre Channel Storage Area Network, ensure Virtual Fibre Channel SAN is selected and click Create.
Under New Fibre Channel SAN, enter a name for this direct connection to FlashArray.
1. The default name is New Fibre Channel SAN. Change it to something that is more recognizable. After that, select the WWNN(s) associated with this connection.
2. If you only have a single path, select all WWNNs. With FlashArray, you should have multiple paths so only select the ones associated with this fabric.
  
  If you are unsure how FlashArray is configured in terms of redundancy/fabrics, check the connection host map found under Health then Connections. Select the host and a similar display will appear as shown.
Click Apply.
Select New Fibre Channel SAN and repeat Step 4 for the other fabric.

Configure Hyper-V - PowerShell

Assign the Worldwide Node Names and Worldwide Port Names to variables.

$WWNs = Get-InitiatorPort | Where {($_.ConnectionType -eq "Fibre Channel") -and ($_.PortAddress -like "*f1*")}

Create the new Virtual SAN with the following command:
```
New-VMSan -Name VirtualSANName 
```

Add the Node and Port Address to the new Virtual San:

Set-VMSan -Name "X70R2 Fabric B" -WorldWideNodeName $wwns.nodeaddress[0],$wwns.nodeaddress[1],$wwns.nodeaddress[2] -worldwideportname $wwns.portaddress[0],$wwns.portaddress[1],$wwns.portaddress[2]

Repeat Step 1 for any other fabrics.

Configure a Virtual Machine to Use Virtual Host Bus Adapters

Once Virtual SAN is configured, a fibre channel adapter (aka a virtual HBA, or vHBA) can be added to VMs. These instructions will show how to achieve that task. Create a Hyper-V VM.

Open the settings for the VM.
Under Add Hardware, select Fibre Channel Adapter and click Add as shown.
After adding the adapter, under Fibre Channel Adapter, in the Virtual SAN dropdown, select a Virtual SAN. An example is shown below.
Select Add Hardware.
Repeat Steps 11 and 12 for the other path/fabric.
Click Apply. If you encounter an error similar to the one shown below, continue to Step 8.
To resolve the error noted in Step 6, use the following PowerShell command:
```
Set-VMSecurity -VMName "NameOfVM" -VirtualizationBasedSecurityOptOut $True
```
1. To verify the property is configured properly, verify with Get-VMSecurity.
If you encounter an error with NPIV similar to the one below, you must enable NPIV on the switch.
1. Log into FlashArray with the CLI. Verify that NPIV, which is set at the switch, is supported with the command puredb npiv supported.
2. If you see an error as shown below, NPIV is not enabled at the switch. To resolve the issue, enable NPIV on the switch(es).
3. Once NPIV is enabled, re-executing the command should show a value of True as shown.
4. You can further verify NPIV with puredb npiv mode and puredb npiv status. Example outputs are shown in below.
Configure the guest OS as you would a physical server, including multipath I/O if necessary.
Add the VM as a host in FlashArray (either via GUI or PowerShell) and provision storage. Use the output of Get-InitiatorPort in the VM to configure the host properly. While there are two different values – World Wide Node Name (WWNN) and World Wide Port Name (WWPN), WWN in FlashArray is the same as the port (WWPN).
1. In the example shown in Figure 20, there are the two vHBAs each with their own port address.
  Note:
  Note that it is a long string. For FlashArray, you will need to format it as a hexadecimal address. The first adapter's port value is c003ff717d1b0016. When entering for FlashArray, it would be C0:03:FF:71:7D:1B:00:16.
2. The figure below show how this configuration translates in FlashArray.
  
  Note: Note that there is one volume assigned to the VM.
If the VM cannot see volumes after properly adding the correct port numbers as WWNs in FlashArray, check the zone settings at the switch. The ports may need to be added there as well. One way to see this is to look at the connection map which will show no connections. Refer to the example below (Connection map for the VM where it is not functioning properly).

The example below shows a VM that has proper zone settings at the switch.