Remote Copy is blocked

[m0be1]

I have set up an Trusted and DMZ network (all virtual)

The LHN SAN network is 1.1.100.0/24 network (trusted)

The DMZ  VSA SAN is on 1.2.100.0/24 network (dmz)

My HP4000 CMC sees both management groups, I have NIC's dedicated (2 each) to both SAN's. I am unable to get my remote copy working. The file copy begins then after a few minutes I am presented with the error: Remote Copy to DMZ in Cluster LHN SAN is blocked because the communication with the primary management group cannot be established.  

I have tried to add to the management group with no luck, I do see the LHN SAN in the Unknown Management Groups, I have disassociated it this did nothing. Still same error.  From many examples I have seen online the SAN networks are all in the same subnet, however with having an DMZ it was advised to make this seperate. How can I begin to make this work?

[oikjn]

sounds like a routing problem.  Do you have your default gateways setup on the VSAs?  If they don't have that, they can't talk out of their subnet which would cause the problem you are saying.

[m0be1]

I have default gateways set on all my VSA's according to thier respective networks. The management server that housed the HP CMC quad Nic's which I have 2 dedicated to each SAN. However these were set up without gateways. I had questioned this configuration and it was stated that the NIC's for the SAN Management did not need default gateways.

[oikjn]

There is no need for a "management server" for the VSAs.  CMC is just used for configuration and monitoring, it doesn't actually run anything in the management group and isn't needed anywhere as each VSA houses the SAN/IQ OS and handles everything itself.  As long as your SAN network is routable (which is required if you are trying to do multi-site sans), it doesn't matter where you keep your CMC instance.  I have two sites I manage and my CMC install is on my desktop computer on a 3rd subnet.

I would verify that your subnets are actually routing correctly.  Assuming you haven't locked it down completely and it can route from your production network to the SAN/DMZ network, try pinging each VSA from your desktop.  If you cannot do that, then most likely you have a network issue not a problem with the VSAs.

[m0be1]

I have added routes via my switches to allow the Networks to talk to each other but still wont work. I am unable to edit the routing on the CMC. Any ideas?

[oikjn]

"the CMC" is your computer, if your computer can ping the VSAs then the CMC program should work. 

You can definitely set the routing information on each VSA.  This is in the TCP/IP tab of each VSA when viewed by the CMC and you can definitely edit that routing table.

Until you can ping from one network to the next, the most likely cause of the problem is your network and not the SAN/IQ