Table of Contents
Advertisement
Chapter 35
Configuring iSCSI
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m .
iSCSI ACL Based Access Control
iSCSI based access control is applicable only if static iSCSI virtual targets are created (see the
Mapping" section on page
that are allowed to access the targets.
By default, static iSCSI virtual targets are not accessible to any iSCSI host. You must explicitly configure
accessibility to allow a iSCSI virtual target to be accessed by all hosts. The initiator access list can
contain one or more initiators. The iSCSI initiator can be identified by one of the following mechanisms:
•
•
•
Note
For transparent mode iSCSI initiator, if both Fibre Channel zoning and iSCSI ACLs are used, then for
every static iSCSI target that is accessible to the iSCSI host, the initiator's virtual N port should be in
the same Fibre Channel zone as the Fibre Channel target.
To configure access control in iSCSI, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# iscsi virtual-target name
iqn.1987-02.com.cisco.initiator
switch(config-iscsi-tgt)#
Step 3
switch(config-iscsi-tgt)# pWWN
26:00:01:02:03:04:05:06
switch(config-iscsi-tgt)#
Step 4
switch(config-iscsi-tgt)# initiator
iqn.1987-02.com.cisco.initiator1 permit
switch(config-iscsi-tgt)# no initiator
iqn.1987-02.com.cisco.initiator1 permit
switch(config-iscsi-tgt)# initiator ip
address 10.50.1.1 permit
switch(config-iscsi-tgt)# no initiator ip
address 10.50.1.1 permit
switch(config-iscsi-tgt)# initiator ip
address 10.50.1.0 255.255.255.0 permit
switch(config-iscsi-tgt)# no initiator ip
address 10.50.1.0 255.255.255.0 permit
switch(config-iscsi-tgt)#
all-initiator-permit
switch(config-iscsi-tgt)# no
all-initiator-permit
OL-6973-03, Cisco MDS SAN-OS Release 2.x
35-7). For a static iSCSI target, you can configure a list of iSCSI initiators
iSCSI node name
IP address
IP subnet
Purpose
Enters configuration mode.
Creates the iSCSI target name
iqn.1987-02.com.cisco.initiator.
Maps a virtual target node to a Fibre Channel
target.
Allows the specified iSCSI initiator node to access
this virtual target. You can issue this command
multiple times to allow multiple initiators.
Prevents the specified initiator node from
accessing virtual targets.
Allows the specified IP address to access this
virtual target. You can issue this command multiple
times to allow multiple initiators.
Prevents the specified IP address from accessing
virtual targets.
Allows all initiators in this subnetwork
(10.50.1/24) to access this virtual target.
Prevents all initiators in this subnetwork from
accessing virtual targets.
Allows all initiator nodes to access this virtual
target.
Prevents any initiator from accessing virtual targets
(default).
Cisco MDS 9000 Family Configuration Guide
Configuring iSCSI
"Static
35-21
Advertisement
Table of Contents
