Access Control In Iscsi; Fibre Channel Zoning-Based Access Control; Iscsi-Based Access Control - Cisco DS-C9216I-K9 Configuration Manual

Configuring iSCSI
Choose Interfaces > FC Logical from the Fabric Manager Physical Attributes pane, or choose
Step 1
Interfaces > Ethernet or iSCSI from Device Manager. You see the Interface tables in the Fabric
Manager Information pane or the Device Manager Interfaces dialog box.
Click the iSCSI tab. You see the iSCSI interface configuration table.
Step 2
In the Initiator Proxy Mode section, check the Enable check box.
Step 3
Click the Apply Changes icon in Fabric Manager or click Apply in Device Manager to save these
Step 4
changes, or click Undo Changes in Fabric Manager or click Cancel in Device Manager to discard
changes.

Access Control in iSCSI

You can control access to each statically-mapped iSCSI target by specifying a list of IPS ports on which
it will be advertised and specifying a list of iSCSI initiator node names allowed to access it. Fibre
Channel zoning-based access control and iSCSI-based access control are the two mechanisms by which
access control can be provided for iSCSI. Both methods can be used simultaneously.
This access control is in addition to the existing Fibre Channel access control. The iSCSI initiator has to
be in the same VSAN and zone as the physical Fibre Channel target.

Fibre Channel Zoning-Based Access Control

Zoning is an access control mechanism within a VSAN. The switch zoning implementation extends the
VSAN and zoning concepts from the Fibre Channel domain to also cover the iSCSI domain. This
extension includes both iSCSI and Fibre Channel features and provides a uniform, flexible access control
across a SAN. Static and dynamic are the two Fibre Channel zoning access control mechanisms.
•
•
To register an iSCSI host initiator as a member of a zone using Fabric Manager, follow these steps:
Choose Zone > Edit Local Full Zone Database.
Step 1
Choose the VSAN and zone to which you want to add the iSCSI host initiator.
Step 2
From the list of available devices including iSCSI host initiators, click on the initiators that you want to
Step 3
add to the zone and click Add to Zone or Alias.
Click Close to close the dialog box.
Step 4

iSCSI-Based Access Control

For static iSCSI targets, you can manually configure a list of iSCSI initiators that are allowed to access
it. The iSCSI initiator is identified by the iSCSI node name or the IP address of the iSCSI host.
Cisco MDS 9000 Fabric Manager Switch Configuration Guide
24-36
Static—Statically map the iSCSI host to Fibre Channel virtual N port(s). This creates a permanent
nWWNs and pWWNs. Next, configure the assigned pWWN into zones, similar to adding a regular
Fibre Channel host pWWN to a zone.
Dynamic—Add the iSCSI host's initiator node name as a member of a zone. When the IP host's
Fibre Channel virtual N port is created and the Fibre Channel address (nWWNs and pWWNs) is
assigned, Fibre Channel zoning is enforced.
Chapter 24 Configuring IP Storage
OL-7753-01