FC group permissions mangled

Hi all,

I have a strange problem with our Fiber Channel setup and would like to know if anyone else has seen this, too:

I'm preparing to use around 15 to 20 FC ports (mostly NPIV - virtual ports for Xen VMs) and would like to isolate access to the corresponding FC LVs for obvious reasons:

- set up aliases for all WWPNs
- created groups (one for every VM)
- assigned a single port alias to each group for the first 10 or so groups.

So far, everything looked good. But then I noticed I had a typo in one of the WWPN alias names:

- deleted alias name
- created new alias name with proper spelling

and finished setting up the port alias to group mapping.

Checking the results, I found out something got messed up badly:
- the first group in the list was ok - one alias in the access list
- the second group had its alias - plus the one from the first group
- the third group had its alias plus the aliases from the first and the second group (or to be precise: those of the second group, as that group already had the first group's alias in it, too)
- and so on

This obviously is mangled, because each alias can only be member of a single group.

So then I started with the second group and removed the excess entry. Though it showed up in the list of "available aliases" after removal (I guess that's a browser-side function) , after applying the change the list for this group only had the (wanted) alias included and some not-used entries in the "available" section.

I've done this for all groups and got the expected result.

Until... I had to change the WWPN alias list again (deleted an excess test entry). Same result, I had to clean up again.

Side notes:
- we have nothing in the default group
- we have one more group with two unrelated WWPNs and four LVs - that group was affected, too
- all but one of the new groups have no LVs associated (yet)

Anyone seen this, too?

With regards,
Jens