Configuring Islb Session Authentication - Cisco MDS 9000 series Configuration Manual

Configuring iSLB
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
zone name ips_zone_IslbZone vsan 1
...

Configuring iSLB Session Authentication

The IPS module and MPS-14/2 module support the iSLB authentication mechanism to authenticate iSLB
hosts that request access to storage. By default, the IPS module and MPS-14/2 module allow CHAP or
None authentication of iSCSI initiators. If authentication is always used, you must configure the switch
to allow only CHAP authentication.
For CHAP user name or secret validation you can use any method supported and allowed by the Cisco
MDS AAA infrastructure (see the Cisco MDS 9000 Family NX-OS Security Configuration Guide for
more information). AAA authentication supports RADIUS, TACACS+, or a local authentication device.
Specifying the iSLB session authentication is the same as for iSCSI. See the
Note
Authentication" section on page
Restricting iSLB Initiator Authentication
By default, the iSLB initiator can use any user name in the RADIUS or local AAA database in
authenticating itself to the IPS module or MPS-14/2 module (the CHAP user name is independent of the
iSLB initiator name). The IPS module or MPS-14/2 module allows the initiator to log in as long as it
provides a correct response to the CHAP challenge sent by the switch. This can be a problem if one
CHAP user name and password have been compromised.
To restrict an initiator to use a specific user name for CHAP authentication, follow these steps:
Command
Step 1
switch# config t
switch(config)#
Step 2
switch(config)# islb initiator
name iqn.1987-02.com.cisco.init
switch(config-islb-init)#
Step 3
switch(config-islb-init)#
username user1
Mutual CHAP Authentication
In addition to the IPS module and MPS-14/2 module authentication of the iSLB initiator, the IPS module
and MPS-14/2 module also support a mechanism for the iSLB initiator to authenticate the Cisco MDS
switch's initiator target during the iSCSI login phase. This authentication requires the user to configure
a user name and password for the switch to present to the iSLB initiator. The provided password is used
to calculate a CHAP response to a CHAP challenge sent to the IPS port by the initiator.
Cisco MDS 9000 Family NX-OS IP Services Configuration Guide
4-48
ip-address 10.1.1.3
pwwn 22:00:00:04:cf:75:28:4d
pwwn 22:00:00:04:cf:75:ed:53
pwwn 22:00:00:04:cf:75:21:d5
pwwn 22:00:00:04:cf:75:ee:59
4-23.
Purpose
Enters configuration mode.
Configures an iSLB initiator using the IQN of the initiator
node and enters iSLB initiator configuration mode.
Restricts the initiator iqn.1987-02.com.cisco.init to only
authenticate using user1 as its CHAP user name.
Be sure to define user1 as an iSCSI user in the local
Tip
AAA database or the RADIUS server.
Chapter 4 Configuring iSCSI
"iSCSI Session
OL-19525-01,Cisco MDS NX-OS Release 4.2(1)