Using esxcli to Mask a LUN from ESXi

Today I was tweeting back and forth with Hersey Cartwright (blog/twitter) about using esxcli to mask LUNs from an ESXi host. Hersey, like myself is studying/preparing for the upcoming VMware VCAP-DCA 5 beta exam and is trying to get as much lab time in as possible. Over the weekend I was working on this topic as well and thought I would put together a quick post outlining the process. The information provided below has been gathered from the “vSphere Command-Line Interface Concepts and Examples” document as well as VMware KB articles KB1009449 and KB1014953.

Lets get started….

First step is to log into you ESXi host with you favorite SSH/Terminal software (using Putty in the screenshots) and run esxcfg-scsidevs –m. The command will list the currently mounted VMFS volumes and there vmhba names. Make note of the naa number for the device you wish  to mask, we will be using it later. In the example screen shot below the device ID is naa.5000144f88249906.


Next up is issuing the esxcfg-mpath –L command. This will provide the next piece of information we need, the number of paths to the device and the vmhba that is in use. For the example below I have a single iSCSI LUN (naa.5000144f88249906) that has two paths. One path going down vmhba37:C1:T0:L0 and the other down vmhba37:C0:T0:L0. Take note of this information as we will be using it further on to create our “rule”


Finally we will get a list of the current claim rules that are in place and to be sure we do not reuse an existing rule number. Issue the esxcli storage core claimrule list command:


From the screenshot above we can see the rules that are currently in place. For my example rules I am going to use rule numbers 200 and 201. Using the information we gathered from the esxcfg-mpath –L above will allow us to complete the needed esxcli command:


Next, verify that your new rules have been created by running another esxcli storage core claimrule list command. Note the new rules, rules 200 and 201:


With the new claim rule added the next step is to “reload” the claim rules via the esxcli storage core claimrule load command:

Note – This is a pretty uneventful screenshot. Smile


With the claim rules reloaded, again run the esxcli storage core claimrule list command and notice the “runtime” entries that have been added:


Now, with the claim rules present we can actually reclaim the LUN or “Mask” it from the ESXi host. This is accomplished with the esxcli storage core claiming reclaim command and use the naa. identifier we collected above:


At this point you have successfully masked the LUN from the ESXi host. If you issue an esxcfg-scsidevs –m you will notice that the device is not longer listed (compared to the screen shots above) or if you do a rescan of the storage adapters from within the vSphere client:


Any questions or comments please let me know, and thank you for reading.