Configure RHEL 10.x for NVMe-oF with ONTAP storage

06/09/2026 Contributors

Red Hat Enterpirse Linux (RHEL) hosts support the NVMe over Fibre Channel (NVMe/FC) and NVMe over TCP (NVMe/TCP) protocols with Asymmetric Namespace Access (ANA). ANA provides multipathing functionality equivalent to asymmetric logical unit access (ALUA) in iSCSI and FCP environments.

Learn how to configure NVMe over Fabrics (NVMe-oF) hosts for RHEL 10.x. For more support and feature information, see RHEL ONTAP support and features.

NVMe-oF with RHEL 10.x has the following known limitations:

The nvme disconnect-all command disconnects both root and data filesystems and might lead to system instability. Do not issue this on systems booting from SAN over NVMe-TCP or NVMe-FC namespaces.

Step 1: Optionally, enable SAN booting

You can configure your host to use SAN booting to simplify deployment and improve scalability. Use the Interoperability Matrix Tool to verify that your Linux OS, host bus adapter (HBA), HBA firmware, HBA boot BIOS, and ONTAP version support SAN booting.

Steps

Create a NVMe namespace and map it to the host.
Enable SAN booting in the server BIOS for the ports to which the SAN boot namespace is mapped.

For information on how to enable the HBA BIOS, see your vendor-specific documentation.
Reboot the host and verify that the OS is up and running.

Step 2: Install RHEL and NVMe software and verify your configuration

To configure your host for NVMe-oF you need to install the host and NVMe software packages, enable multipathing, and verify your host NQN configuration.

Steps

Install RHEL 10.x on the server. After the installation is complete, verify that you are running the required RHEL 10.x kernel:
```
uname -r
```
Example RHEL kernel version:
```
6.12.0-211.7.3.el10_2.x86_64
```
Install the nvme-cli package:
```
rpm -qa|grep nvme-cli
```
The following example shows an nvme-cli package version:
```
nvme-cli-2.16-2.el10.x86_64
```
Install the libnvme package:
```
rpm -qa|grep libnvme
```
The following example shows an libnvme package version:
```
libnvme-1.16.1-3.el10_2.x86_64
```
On the host, check the hostnqn string at /etc/nvme/hostnqn:
```
cat /etc/nvme/hostnqn
```
The following example shows an hostnqn version:
```
nqn.2014-08.org.nvmexpress:uuid:4c4c4544-0056-5410-8048-c7c04f425633
```

On the ONTAP system, verify that the hostnqn string matches the hostnqn string for the corresponding subsystem on the ONTAP storage system:

::> vserver nvme subsystem host show -vserver vs_coexistence_QLE2872

Show example

Vserver Subsystem Priority  Host NQN
------- --------- --------  ------------------------------------------------
vs_coexistence_QLE2872
               subsystem_1
                         regular   nqn.2014-08.org.nvmexpress:uuid:4c4c4544-0056-5410-8048-c7c04f425633
               subsystem_10
                         regular   nqn.2014-08.org.nvmexpress:uuid:4c4c4544-0056-5410-8048-c7c04f425633
               subsystem_11
                         regular   nqn.2014-08.org.nvmexpress:uuid:4c4c4544-0056-5410-8048-c7c04f425633

If the hostnqn strings do not match, use the vserver modify command to update the hostnqn string on your corresponding ONTAP storage system subsystem to match the hostnqn string from /etc/nvme/hostnqn on the host.

Step 3: Configure NVMe/FC and NVMe/TCP

Configure NVMe/FC with Broadcom/Emulex or Marvell/QLogic adapters, or configure NVMe/TCP using manual discovery and connect operations.

NVMe/FC - Broadcom/Emulex

Configure NVMe/FC for a Broadcom/Emulex adapter.

Steps

Verify that you are using the supported adapter model:
1. Display the model names:
  cat /sys/class/scsi_host/host*/modelname
  You should see the following output:
  SN1700E2P SN1700E2P
2. Display the model descriptions:
  cat /sys/class/scsi_host/host*/modeldesc
  You should see an output similar to the following example:
  HPE SN1700E 64Gb 2p FC HBA HPE SN1700E 64Gb 2p FC HBA
Verify that you are using the recommended Broadcom lpfc firmware and inbox driver:
1. Display the firmware version:
  cat /sys/class/scsi_host/host*/fwrev
  The command returns the firmware versions:
  14.4.731.5, sli-4:6:d 14.4.731.5, sli-4:6:d
2. Display the inbox driver version:
  cat /sys/module/lpfc/version
  The following example shows a driver version:
  0:14.4.0.12
For the current list of supported adapter driver and firmware versions, see the Interoperability Matrix Tool.

Verify that lpfc_enable_fc4_type is set to 3:

cat /sys/module/lpfc/parameters/lpfc_enable_fc4_type

Verify that you can view your initiator ports:
```
cat /sys/class/fc_host/host*/port_name
```
You should see an output similar to:
```
0x10005ced8c53092a
0x10005ced8c53092a
```
Verify that your initiator ports are online:
```
cat /sys/class/fc_host/host*/port_state
```
You should see the following output:
```
Online
Online
```

Verify that the NVMe/FC initiator ports are enabled and that the target ports are visible:

cat /sys/class/scsi_host/host*/nvme_info

Show example

NVME Initiator Enabled
XRI Dist lpfc0 Total 6144 IO 5894 ELS 250
NVME LPORT lpfc0 WWPN x10005ced8c53092a WWNN x20005ced8c53092a DID x081e00 ONLINE
NVME RPORT       WWPN x2049d039eac0cc5b WWNN x2047d039eac0cc5b DID x082208 TARGET DISCSRVC ONLINE
NVME RPORT       WWPN x2008d039eac0cc5b WWNN x2007d039eac0cc5b DID x082202 TARGET DISCSRVC ONLINE
NVME RPORT       WWPN x2009d039eac0cc5b WWNN x2007d039eac0cc5b DID x082602 TARGET DISCSRVC ONLINE
NVME RPORT       WWPN x2048d039eac0cc5b WWNN x2047d039eac0cc5b DID x08260a TARGET DISCSRVC ONLINE


NVME Statistics
LS: Xmt 0000004553 Cmpl 0000004553 Abort 00000000
LS XMIT: Err 00000000  CMPL: xb 00000000 Err 00000000
Total FCP Cmpl 000000000578fc29 Issue 000000000578fc8d OutIO 0000000000000064
        abort 00004f7c noxri 00000001 nondlp 000002da qdepth
00000000 wqerr 0000168a err 00000000
FCP CMPL: xb 00005033 Err 0000aa85

NVME Initiator Enabled
XRI Dist lpfc1 Total 6144 IO 5894 ELS 250
NVME LPORT lpfc1 WWPN x10005ced8c53092b WWNN x20005ced8c53092b DID x031f00 ONLINE
NVME RPORT       WWPN x204bd039eac0cc5b WWNN x2047d039eac0cc5b DID x03250a TARGET DISCSRVC ONLINE
NVME RPORT       WWPN x200ad039eac0cc5b WWNN x2007d039eac0cc5b DID x032502 TARGET DISCSRVC ONLINE
NVME RPORT       WWPN x204ed039eac0cc5b WWNN x2047d039eac0cc5b DID x03260a TARGET DISCSRVC ONLINE
NVME RPORT       WWPN x200bd039eac0cc5b WWNN x2007d039eac0cc5b DID x032602 TARGET DISCSRVC ONLINE


NVME Statistics
LS: Xmt 0000004509 Cmpl 0000004509 Abort 00000000
LS XMIT: Err 00000000  CMPL: xb 00000000 Err 00000000
Total FCP Cmpl 000000000571ddc6 Issue 000000000571de28 OutIO 0000000000000062
        abort 0000421e noxri 00000000 nondlp 00000491 qdepth
00000000 wqerr 00000120 err 00000000
FCP CMPL: xb 00004410 Err 0000995c

NVMe/FC - Marvell/QLogic

Configure NVMe/FC for a Marvell/QLogic adapter.

Steps

Verify that you are using the supported adapter driver and firmware versions:
```
cat /sys/class/fc_host/host*/symbolic_name
```
The following example shows driver and firmware versions:
```
QLE2872 FW:v9.15.06 DVR:v10.02.10.100-k-debug
QLE2872 FW:v9.15.06 DVR:v10.02.10.100-k-debug
```
Verify that ql2xnvmeenable is set. This enables the Marvell adapter to function as an NVMe/FC initiator:
```
cat /sys/module/qla2xxx/parameters/ql2xnvmeenable
```
The expected output is 1.

NVMe/TCP

The NVMe/TCP protocol doesn't support the auto-connect operation. Instead, you can discover the NVMe/TCP subsystems and namespaces by performing the NVMe/TCP connect or connect-all operations manually.

Steps

Check that the initiator port can get the discovery log page data across the supported NVMe/TCP LIFs:

nvme discover -t tcp -w host-traddr -a traddr

Show example

nvme discover -t tcp -w 192.168.20.1 -a 192.168.20.26
Discovery Log Number of Records 196, Generation counter 245
=====Discovery Log Entry 0======
trtype:  tcp
adrfam:  ipv4
subtype: current discovery subsystem
treq:    not specified
portid:  9
trsvcid: 8009
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:discovery
traddr:  192.168.21.26
eflags:  explicit discovery connections, duplicate discovery information
sectype: none
=====Discovery Log Entry 1======
trtype:  tcp
adrfam:  ipv4
subtype: current discovery subsystem
treq:    not specified
portid:  7
trsvcid: 8009
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:discovery
traddr:  192.168.20.26
eflags:  explicit discovery connections, duplicate discovery information
sectype: none
=====Discovery Log Entry 2======
trtype:  tcp
adrfam:  ipv4
subtype: current discovery subsystem
treq:    not specified
portid:  11
trsvcid: 8009
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:discovery
traddr:  192.168.20.27
eflags:  explicit discovery connections, duplicate discovery information
sectype: none
=====Discovery Log Entry 3======
trtype:  tcp
adrfam:  ipv4

subtype: current discovery subsystem
treq:    not specified
portid:  5
trsvcid: 8009
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:discovery
traddr:  192.168.21.27
eflags:  explicit discovery connections, duplicate discovery information
sectype: none
=====Discovery Log Entry 4======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  9
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Bidirectional_DHCP_NONE_1_5
traddr:  192.168.21.26
eflags:  none
sectype: none
=====Discovery Log Entry 5======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  7
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Bidirectional_DHCP_NONE_1_5
traddr:  192.168.20.26
eflags:  none
sectype: none
=====Discovery Log Entry 6======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  11
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Bidirectional_DHCP_NONE_1_5
traddr:  192.168.20.27
eflags:  none
sectype: none
=====Discovery Log Entry 7======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  5
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Bidirectional_DHCP_NONE_1_5
traddr:  192.168.21.27
eflags:  none
sectype: none
=====Discovery Log Entry 8======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  9
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_1_0
traddr:  192.168.21.26
eflags:  none
sectype: none
=====Discovery Log Entry 9======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  7
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_1_0
traddr:  192.168.20.26
eflags:  none
sectype: none
=====Discovery Log Entry 10======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  11
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_1_0
traddr:  192.168.20.27
eflags:  none
sectype: none
=====Discovery Log Entry 11======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  5
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_1_0
traddr:  192.168.21.27
eflags:  none
sectype: none
=====Discovery Log Entry 12======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  9
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_2_0
traddr:  192.168.21.26
eflags:  none
sectype: none
=====Discovery Log Entry 13======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  7
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_2_0
traddr:  192.168.20.26
eflags:  none
sectype: none
=====Discovery Log Entry 14======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  11
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_2_0
traddr:  192.168.20.27
eflags:  none
sectype: none
=====Discovery Log Entry 15======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  5
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_2_0
traddr:  192.168.21.27
eflags:  none
sectype: none
=====Discovery Log Entry 16======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  9
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_NONE_1_4
traddr:  192.168.21.26
eflags:  none
sectype: none
=====Discovery Log Entry 17======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  7
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_NONE_1_4
traddr:  192.168.20.26
eflags:  none
sectype: none
=====Discovery Log Entry 18======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  11
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_NONE_1_4
traddr:  192.168.20.27
eflags:  none
sectype: none
=====Discovery Log Entry 19======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  5
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_NONE_1_4
traddr:  192.168.21.27
eflags:  none
sectype: none
=====Discovery Log Entry 20======
trtype:  tcp
adrfam:  ipv4
subtype: nvme subsystem
treq:    not specified
portid:  9
trsvcid: 4420
subnqn:  nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Unidirectional_DHCP_NONE_2_3
traddr:  192.168.21.26
eflags:  none
sectype: none
…

Verify that the other NVMe/TCP initiator-target LIF combinations can successfully retrieve discovery log page data:

nvme discover -t tcp -w host-traddr -a traddr

Show example

nvme discover -t tcp -w 192.168.20.1 -a 192.168.20.26
nvme discover -t tcp -w 192.168.21.1 -a 192.168.21.26
nvme discover -t tcp -w 192.168.20.1 -a 192.168.20.27
nvme discover -t tcp -w 192.168.21.1 -a 192.168.21.27

Run the nvme connect-all command across all the supported NVMe/TCP initiator-target LIFs across the nodes:

nvme connect-all -t tcp -w host-traddr -a traddr

Show example

nvme	connect-all -t	tcp -w	192.168.20.1	-a 192.168.20.26
nvme	connect-all -t	tcp -w	192.168.21.1	-a 192.168.21.26
nvme	connect-all -t	tcp -w	192.168.20.1	-a 192.168.20.27
nvme	connect-all -t	tcp -w	192.168.21.1	-a 192.168.21.27

Beginning with RHEL 9.4, the setting for the NVMe/TCP ctrl_loss_tmo timeout is automatically set to "off". As a result:

There are no limits on the number of retries (indefinite retry).
You don't need to manually configure a specific ctrl_loss_tmo timeout duration when using the nvme connect or nvme connect-all commands (option -l ).
The NVMe/TCP controllers don't experience timeouts in the event of a path failure and remain connected indefinitely.

Step 4: Optionally, modify the iopolicy in the udev rules

Changes to iopolicy for RHEL 10.x Releases

Beginning with RHEL 10.1, the default iopolicy is queue-depth.
In RHEL 10.0, round-robin is the default iopolicy, but queue-depth is available as a configurable option.

If you are using RHEL 10.0 and want to change the iopolicy to queue-depth, modify the udev rules file as follows:

Steps

Open the udev rules file in a text editor with root privileges:
```
/usr/lib/udev/rules.d/71-nvmf-netapp.rules
```
You should see the following output:
```
vi /usr/lib/udev/rules.d/71-nvmf-netapp.rules
```

Find the line that sets iopolicy for the NetApp ONTAP Controller, as shown in the following example rule:

ACTION=="add", SUBSYSTEM=="nvme-subsystem", ATTR{subsystype}=="nvm", ATTR{model}=="NetApp ONTAP Controller", ATTR{iopolicy}="round-robin"

Modify the rule so that round-robin becomes queue-depth:

ACTION=="add", SUBSYSTEM=="nvme-subsystem", ATTR{subsystype}=="nvm", ATTR{model}=="NetApp ONTAP Controller", ATTR{iopolicy}="queue-depth"

Reload the udev rules and apply the changes:

udevadm control --reload
udevadm trigger --subsystem-match=nvme-subsystem

Verify the current iopolicy for your subsystem. Replace <subsystem>, for example, nvme-subsys0.
```
cat /sys/class/nvme-subsystem/<subsystem>/iopolicy
```
You should see the following output:
```
queue-depth.
```

The new iopolicy applies automatically to matching NetApp ONTAP Controller devices. You don't need to reboot.

Step 5: Optionally, enable 1MB I/O for NVMe/FC

ONTAP reports a Max Data Transfer Size (MDTS) of 8 in the Identify Controller data. This means the maximum I/O request size can be up to 1MB. To issue I/O requests of size 1MB for a Broadcom NVMe/FC host, you should increase the lpfc value of the lpfc_sg_seg_cnt parameter to 256 from the default value of 64.

These steps don't apply to Qlogic NVMe/FC hosts.

Steps

Set the lpfc_sg_seg_cnt parameter to 256:
```
cat /etc/modprobe.d/lpfc.conf
```
You should see an output similar to the following example:
```
options lpfc lpfc_sg_seg_cnt=256
```
Run the dracut -f command, and reboot the host.

Verify that the value for lpfc_sg_seg_cnt is 256:

cat /sys/module/lpfc/parameters/lpfc_sg_seg_cnt

Step 6: Verify NVMe boot services

The nvmefc-boot-connections.service and nvmf-autoconnect.service boot services included in the NVMe/FC nvme-cli package are automatically enabled when the system boots.

After booting completes, verify that the nvmefc-boot-connections.service and nvmf-autoconnect.service boot services are enabled.

Steps

Verify that nvmf-autoconnect.service is enabled:

systemctl status nvmf-autoconnect.service

Show example output

nvmf-autoconnect.service - Connect NVMe-oF subsystems automatically during boot
     Loaded: loaded (/usr/lib/systemd/system/nvmf-autoconnect.service; enabled; preset: disabled)
     Active: inactive (dead) since Sun 2026-04-19 02:19:18 EDT; 2 days ago
 Invocation: 4a0dab1649ff454b957224c7fcafbe1d
   Main PID: 9704 (code=exited, status=0/SUCCESS)
   Mem peak: 3M
        CPU: 44ms

Apr 19 02:19:18 R650-14-194.lab.eng.btc.netapp.in systemd[1]: Starting nvmf-autoconnect.service - Connect NVMe-oF subsystems automatically during boot...
Apr 19 02:19:18 R650-14-194.lab.eng.btc.netapp.in systemd[1]: nvmf-autoconnect.service: Deactivated successfully.
Apr 19 02:19:18 R650-14-194.lab.eng.btc.netapp.in systemd[1]: Finished nvmf-autoconnect.service - Connect NVMe-oF subsystems automatically during boot.

Verify that nvmefc-boot-connections.service is enabled:

systemctl status nvmefc-boot-connections.service

Show example output

nvmefc-boot-connections.service - Auto-connect to subsystems on FC-NVME devices found during boot
     Loaded: loaded (/usr/lib/systemd/system/nvmefc-boot-connections.service; enabled; preset: enabled)
     Active: inactive (dead) since Sun 2026-04-19 02:19:09 EDT; 2 days ago
 Invocation: da450120872f454d8264f1dfa0c646e3
   Main PID: 4277 (code=exited, status=0/SUCCESS)
   Mem peak: 2.9M
        CPU: 15ms

Apr 19 02:19:09 R650-14-194.lab.eng.btc.netapp.in systemd[1]: Starting nvmefc-boot-connections.service - Auto-connect to subsystems on FC-NVME devices found during boot.
Apr 19 02:19:09 R650-14-194.lab.eng.btc.netapp.in systemd[1]: nvmefc-boot-connections.service: Deactivated successfully.
Apr 19 02:19:09 R650-14-194.lab.eng.btc.netapp.in systemd[1]: Finished nvmefc-boot-connections.service - Auto-connect to subsystems on FC-NVME devices found during boot.

Step 7: Verify the multipathing configuration

Verify that the in-kernel NVMe multipath status, ANA status, and ONTAP namespaces are correct for the NVMe-oF configuration.

Steps

Verify that the appropriate NVMe-oF settings (such as, model set to NetApp ONTAP Controller and load balancing iopolicy set to queue-depth) for the respective ONTAP namespaces correctly display on the host:
1. Display the subsystems:
  cat /sys/class/nvme-subsystem/nvme-subsys*/model
  You should see the following output:
  NetApp ONTAP Controller NetApp ONTAP Controller
2. Display the policy:
  cat /sys/class/nvme-subsystem/nvme-subsys*/iopolicy
  You should see the following output:
  queue-depth queue-depth

Verify that the namespaces are created and correctly discovered on the host:

nvme list

Show example

Node                  Generic               SN                   Model
--------------------- --------------------- -------------------- ----------------------------------------
/dev/nvme11n1         /dev/ng11n1           81OcqJXhgWtsAAAAAAAI NetApp ONTAP Controller

Namespace  Usage                      Format           FW Rev
---------- -------------------------- ---------------- --------
0x1        951.90  MB /  21.47  GB    4 KiB +  0 B     9.18.1

Verify that the controller state of each path is live and has the correct ANA status:

nvme list-subsys /dev/<controller_ID>

Beginning with ONTAP 9.16.1, NVMe/FC and NVMe/TCP report all optimized paths on ASA r2 systems.

NVMe/FC

This following example outputs show a namespace hosted on a two-node ONTAP controller for AFF, FAS, and ASA systems and ASA r2 system with NVMe/FC.

Show AFF, FAS, and ASA example output

nvme-subsys5 - NQN=nqn.1992-08.com.netapp:sn.f7565b15a66911ef9668d039ea951c46:subsystem.nvme 1
hostnqn=nqn.2014-08.org.nvmexpress:uuid:4c4c4544-0056-5410-8048-c7c04f425633
\
+- nvme126 fc traddr=nn-0x2036d039ea951c45:pn-0x2038d039ea951c45,host_traddr=nn-0x2000f4c7aa0cd7c3:pn-0x2100f4c7aa0cd7c3 live optimized
+- nvme176 fc traddr=nn-0x2036d039ea951c45:pn-0x2037d039ea951c45,host_traddr=nn-0x2000f4c7aa0cd7c2:pn-0x2100f4c7aa0cd7c2 live optimized
+- nvme5 fc traddr=nn-0x2036d039ea951c45:pn-0x2039d039ea951c45,host_traddr=nn-0x2000f4c7aa0cd7c2:pn-0x2100f4c7aa0cd7c2 live non-optimized
+- nvme71 fc traddr=nn-0x2036d039ea951c45:pn-0x203ad039ea951c45,host_traddr=nn-0x2000f4c7aa0cd7c3:pn-0x2100f4c7aa0cd7c3 live non-optimized

Show ASA r2 example output

nvme-subsys96 - NQN=nqn.1992-08.om.netapp:sn.b351b2b6777b11f0b3c2d039ea5cfc91:subsystem.nvme2 4
hostnqn=nqn.2014-08.org.nvmexpress:uuid:d3b581b4-c975-11e6-8425-0894ef31a074
\
+- nvme203 fc traddr=nn-0x2011d039ea5cfc90:pn-0x2015d039ea5cfc90,host_traddr=nn-0x200000109bdacc76:pn-0x100000109bdacc76 live optimized
+- nvme25 fc traddr=nn-0x2011d039ea5cfc90:pn-0x2014d039ea5cfc90,host_traddr=nn-0x200000109bdacc75:pn-0x100000109bdacc75 live optimized
+- nvme30 fc traddr=nn-0x2011d039ea5cfc90:pn-0x2012d039ea5cfc90,host_traddr=nn-0x200000109bdacc75:pn-0x100000109bdacc75 live optimized
+- nvme32 fc traddr=nn-0x2011d039ea5cfc90:pn-0x2013d039ea5cfc90,host_traddr=nn-0x200000109bdacc76:pn-0x100000109bdacc76 live optimized

NVMe/TCP

This following example outputs show a namespace hosted on a two-node ONTAP controller for AFF, FAS, and ASA systems and ASA r2 systems with NVMe/TCP.

Show AFF, FAS, and ASA example output

nvme-subsys4 - NQN=nqn.1992-08.com.netapp:sn.64e65e6caae711ef9668d039ea951c46:subsystem.nvme4
               hostnqn=nqn.2014-08.org.nvmexpress:uuid:4c4c4544-0035-5910-804b-c2c04f444d33
\
 +- nvme102 tcp traddr=192.168.21.20,trsvcid=4420,host_traddr=192.168.21.1,src_addr=192.168.21.1 live non-optimized
 +- nvme151 tcp traddr=192.168.21.21,trsvcid=4420,host_traddr=192.168.21.1,src_addr=192.168.21.1 live optimized
 +- nvme4 tcp traddr=192.168.20.20,trsvcid=4420,host_traddr=192.168.20.1,src_addr=192.168.20.1 live non-optimized
 +- nvme53 tcp traddr=192.168.20.21,trsvcid=4420,host_traddr=192.168.20.1,src_addr=192.168.20.1 live optimized

Show ASA r2 example output

nvme-subsys6 - NQN= nqn.1992-08.com.netapp:sn.08818e1f130811f1b8b4d039eac0cc5b:subsystem.Bidi rectional_DHCP_1_0
hostnqn=nqn.2014-08.org.nvmexpress:uuid:39313550-3033-4931-3544-30573030394c
\
+- nvme4 tcp traddr=192.168.20.26,trsvcid=4420,host_traddr=192.168.20.1,src_ addr=192.168.20.1 live optimized
+- nvme5 tcp traddr=192.168.20.27,trsvcid=4420,host_traddr=192.168.20.1,src_ addr=192.168.20.1 live optimized
+- nvme6 tcp traddr=192.168.21.26,trsvcid=4420,host_traddr=192.168.21.1,src_ addr=192.168.21.1 live optimized
+- nvme7 tcp traddr=192.168.21.27,trsvcid=4420,host_traddr=192.168.21.1,src_ addr=192.168.21.1 live optimized

Verify that the NetApp plug-in displays the correct values for each ONTAP namespace device:

Column

nvme netapp ontapdevices -o column

Show example

Device           Vserver                   Subsystem                 Namespace Path
---------------- ------------------------- ------------------------- ------------------
/dev/nvme0n1     linux_tcnvme_iscsi        Bidirectional_DHCP_1_0       tcp_1

NSID UUID                                   Size
---- -------------------------------------- ---------
1    98fdc7cc-1407-11f1-b4eb-d039eac0cc5b   322.12GB

JSON

nvme netapp ontapdevices -o json

Show example

{
  "ONTAPdevices":[
    {
      "Device":"/dev/nvme0n1",
      "Vserver":"vs_nvme_sanboot_tcp",
      "Subsystem":"rhel_sanboot_tcp170",
      "Namespace_Path":"tcp_97",
      "NSID":1,
      "UUID":"982c0f2a-6b8b-11f0-a6c0-d039eac03c33",
      "LBA_Size":4096,
      "Namespace_Size":322122547200,
      "UsedBytes":16285069312,
      "Version":"9.18.1"
    }
]
}

Step 8: Set up secure in-band authentication

Secure in-band authentication is supported over NVMe/TCP between a RHEL 10.x host and an ONTAP controller.

Each host or controller must be associated with a DH-HMAC-CHAP key to set up secure authentication. A DH-HMAC-CHAP key is a combination of the NQN of the NVMe host or controller and an authentication secret configured by the administrator. To authenticate its peer, an NVMe host or controller must recognize the key associated with the peer.

Steps

Set up secure in-band authentication using the CLI or a config JSON file. If you need to specify different dhchap keys for different subsystems, you must use a config JSON file.

CLI

Set up secure in-band authentication using the CLI.

Obtain the host NQN:
```
cat /etc/nvme/hostnqn
```

Generate the dhchap key for the RHEL 10.x host.

The following output describes the gen-dhchap-key command parameters:

nvme gen-dhchap-key -s optional_secret -l key_length {32|48|64} -m HMAC_function {0|1|2|3} -n host_nqn
•	-s secret key in hexadecimal characters to be used to initialize the host key
•	-l length of the resulting key in bytes
•	-m HMAC function to use for key transformation
0 = none, 1- SHA-256, 2 = SHA-384, 3=SHA-512
•	-n host NQN to use for key transformation

In the following example, a random dhchap key with HMAC set to 3 (SHA-512) is generated.

nvme gen-dhchap-key -m 3 -n nqn.2014-08.org.nvmexpress:uuid:39313550-3033-4931-3544-30573030394c DHHC-1:03:sdLD7EmvjGj8J9CNNe+my2i9JnuI6bIjhPrtcNRs5q6sAKW2HFPh4L3MjhTh49bxZsYSZlqe39CHUvT1+/EjGfqrl0U=:

On the ONTAP controller, add the host and specify both dhchap keys:

vserver nvme subsystem host add -vserver <svm_name> -subsystem <subsystem> -host-nqn <host_nqn> -dhchap-host-secret <authentication_host_secret> -dhchap-controller-secret <authentication_controller_secret> -dhchap-hash-function {sha-256|sha-512} -dhchap-group {none|2048-bit|3072-bit|4096-bit|6144-bit|8192-bit}

A host supports two types of authentication methods, unidirectional and bidirectional. On the host, connect to the ONTAP controller and specify dhchap keys based on the chosen authentication method:
```
nvme connect -t tcp -w <host-traddr> -a <tr-addr> -n <host_nqn> -S <authentication_host_secret> -C <authentication_controller_secret>
```

Validate the nvme connect authentication command by verifying the host and controller dhchap keys:

Verify the host dhchap keys:

cat /sys/class/nvme-subsystem/<nvme-subsysX>/nvme*/dhchap_secret

Show example output for a unidirectional configuration

cat /sys/class/nvme-subsystem/nvme-subsys5/nvme*/dhchap_secret
DHHC-1:01:+qRDBvUBDK+yy7vgsH9YXY8mqfo4ss6FEER9ubjAuhs0I+gZ:
DHHC-1:01:+qRDBvUBDK+yy7vgsH9YXY8mqfo4ss6FEER9ubjAuhs0I+gZ:
DHHC-1:01:+qRDBvUBDK+yy7vgsH9YXY8mqfo4ss6FEER9ubjAuhs0I+gZ:
DHHC-1:01:+qRDBvUBDK+yy7vgsH9YXY8mqfo4ss6FEER9ubjAuhs0I+gZ:

Verify the controller dhchap keys:

cat /sys/class/nvme-subsystem/<nvme-subsysX>/nvme*/dhchap_ctrl_secret

Show example output for a bidirectional configuration

cat /sys/class/nvme-subsystem/nvme-subsys5/nvme*/dhchap_ctrl_secret
DHHC-1:03:sdLD7EmvjGj8J9CNNe+my2i9JnuI6IjhPrtcNRs5q6sAKW2HFPh4L3MjhTh49bxZsYSZlqe39CHUvT1+/EjGfqrl0U=:
DHHC-1:03:sdLD7EmvjGj8J9CNNe+my2i9JnuI6IjhPrtcNRs5q6sAKW2HFPh4L3MjhTh49bxZsYSZlqe39CHUvT1+/EjGfqrl0U=:
DHHC-1:03:sdLD7EmvjGj8J9CNNe+my2i9JnuI6IjhPrtcNRs5q6sAKW2HFPh4L3MjhTh49bxZsYSZlqe39CHUvT1+/EjGfqrl0U=:
DHHC-1:03:sdLD7EmvjGj8J9CNNe+my2i9JnuI6IjhPrtcNRs5q6sAKW2HFPh4L3MjhTh49bxZsYSZlqe39CHUvT1+/EjGfqrl0U=:

JSON

When multiple NVMe subsystems are available on the ONTAP controller, you can use the /etc/nvme/config.json file with the nvme connect-all command.

Use the -o option to generate the JSON file. Refer to the NVMe connect-all man pages for more syntax options.

Configure the JSON file.

In the following example, dhchap_key corresponds to dhchap_secret and dhchap_ctrl_key corresponds to dhchap_ctrl_secret.

Show example

[
  {
    "hostnqn":" nqn.2014-08.org.nvmexpress:uuid:39313550-3033-4931-3544-30573030394c",
    "hostid":"44454c4c-5400-1051-8039-c3c04f523034",
    "dhchap_key":" DHHC-1:01:+qRDBvUBDK+yy7vgsH9YXY8mqfo4ss6FEER9ubjAuhs0I+gZ: ",
    "subsystems":[

      {
        "nqn":"nqn.1992-08.com.netapp:sn.5857c8c9b22411f08d0ed039eac03c33:subsystem.Bidi rectional_DHCP_1_0",
        "ports":[

          {
            "transport":"tcp",
            "traddr":"192.168.20.26",
            "host_traddr":"192.168.20.1",
            "trsvcid":"4420",
            "dhchap_ctrl_key":" DHHC-1:03:sdLD7EmvjGj8J9CNNe+my2i9JnuI6bIjhPrtcNRs5q6sAKW2HFPh4L3MjhTh49bxZsYSZlqe39CHUvT1+/EjGfqrl0U=: "
          },
          {
            "transport":"tcp",
            "traddr":"192.168.20.27",
            "host_traddr":"192.168.20.1",
            "trsvcid":"4420",
            "dhchap_ctrl_key":" DHHC-1:03:sdLD7EmvjGj8J9CNNe+my2i9JnuI6bIjhPrtcNRs5q6sAKW2HFPh4L3MjhTh49bxZsYSZlqe39CHUvT1+/EjGfqrl0U=: "
          },
          {
            "transport":"tcp",
            "traddr":"192.168.21.26",
            "host_traddr":"192.168.21.1",
            "trsvcid":"4420",
            "dhchap_ctrl_key":" DHHC-1:03:sdLD7EmvjGj8J9CNNe+my2i9JnuI6bIjhPrtcNRs5q6sAKW2HFPh4L3MjhTh49bxZsYSZlqe39CHUvT1+/EjGfqrl0U=: "
          },
          {
            "transport":"tcp",
            "traddr":"192.168.21.27",
            "host_traddr":"192.168.21.1",
            "trsvcid":"4420",
            "dhchap_ctrl_key":" DHHC-1:03:sdLD7EmvjGj8J9CNNe+my2i9JnuI6bIjhPrtcNRs5q6sAKW2HFPh4L3MjhTh49bxZsYSZlqe39CHUvT1+/EjGfqrl0U=:
          }
        ]
      }
    ]
  }
]

Connect to the ONTAP controller using the config JSON file:

nvme connect-all -J /etc/nvme/config.json

Show example

traddr=192.168.20.26 is already connected
traddr=192.168.20.27 is already connected
traddr=192.168.20.26 is already connected
traddr=192.168.20.27 is already connected

Verify that the dhchap secrets have been enabled for the respective controllers for each subsystem.

Verify the host dhchap keys:

cat /sys/class/nvme-subsystem/nvme-subsys4/nvme4/dhchap_secret

The following example shows a dhchap key:

DHHC-1:01:2G7lsg9PMO00h1Wf1g4QtP0XT11kREz0qVuLm2xvZdbaWR/g:

Verify the controller dhchap keys:

cat /sys/class/nvme-subsystem/nvme-subsys5/nvme5/dhchap_ctrl_secret

You should see an output similar to the following example:

DHHC-1:03:sdLD7EmvjGj8J9CNNe+my2i9JnuI6bIjhPrtcNRs5q6sAKW2HFPh4L3MjhTh49bxZsYSZlqe39CHUvT1+/EjGfqrl0U=:

Step 9: Review the known issues

There are no known issues.

Configure RHEL 10.x for NVMe-oF with ONTAP storage

Creating your file...

Step 1: Optionally, enable SAN booting

Step 2: Install RHEL and NVMe software and verify your configuration

Step 3: Configure NVMe/FC and NVMe/TCP

Step 4: Optionally, modify the iopolicy in the udev rules

Step 5: Optionally, enable 1MB I/O for NVMe/FC

Step 6: Verify NVMe boot services

Step 7: Verify the multipathing configuration

Step 8: Set up secure in-band authentication

Step 9: Review the known issues