TOPIC:

Both have

i rebooted both hosts.

before hosts changed roles all work fine.

Your LVM filter should also be blocking the local drbd device (/dev/drbd1)

try changing this:
filter = [ "r|/dev/xvd.|", "r|/dev/VG_Xen.*/*|", "r|/dev/sda3|"]

to

filter = [ "r|/dev/xvd.|", "r|/dev/VG_Xen.*/*|", "r|/dev/sda3|", "r|/dev/drbd.*|" ]

once done, delete any lvm cache on the systems and scan for signatures against the new filter.

rm –f /etc/lvm/cache/.cache && vgscan

when done - stop everything and restart
service iscsi-ha stop -w
service tgtd stop (if this fails try forcedstop instead)
service drbd stop
service iscsi-ha start -w (this will start tgtd and drbd in the correct order)

Done all, nothing changed.

also i tried after hosts reboot.

Given that the LVM filters were not properly set, this could be a situation where XS was reading/writing directly to the DRBD device on the master - bypassing the iscsi target. You may have to detach and reattach the isci SR to get it to read correctly at this point.

Is this a production system?

no, this is test system to study HA-LIZARD before use in production.

but, why error in DRBD if second host cannot connect to ISCSI-HA storage?
i repeat, all work fine before HA-LIZARD changed roles on hosts(as part of tests), so what can cause error when HA-LIZARD change roles of servers?

on first of the hosts ISCSI work fully fine.

You should consider starting over again - this time paying careful attention to the LVM filters. The filter should block both the backing device (eg. sda) AND the DRBD device. If this is not properly set then XS can read the DRBD device directly since the same VG name would be exposed via DRBD AND the iscsi target.

So, even though it seems to have worked fine, I suspect that your host was mounting the VG from DRBD rather then iscsi