Configuring Islb Session Authentication - Cisco AP776A - Nexus Converged Network Switch 5020 Configuration Manual

Configuring iSLB
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
zone name ips_zone_IslbZone vsan 1
...

Configuring iSLB Session Authentication

The IPS module and MPS-14/2 module support the iSLB authentication mechanism to authenticate iSLB
hosts that request access to storage. By default, the IPS module and MPS-14/2 module allow CHAP or
None authentication of iSCSI initiators. If authentication is always used, you must configure the switch
to allow only CHAP authentication.
For CHAP user name or secret validation you can use any method supported and allowed by the Cisco
MDS AAA infrastructure (see
authentication supports RADIUS, TACACS+, or a local authentication device.
Specifying the iSLB session authentication is the same as for iSCSI. See the
Note
Authentication" section on page
Restricting iSLB Initiator Authentication
By default, the iSLB initiator can use any user name in the RADIUS or local AAA database in
authenticating itself to the IPS module or MPS-14/2 module (the CHAP user name is independent of the
iSLB initiator name). The IPS module or MPS-14/2 module allows the initiator to log in as long as it
provides a correct response to the CHAP challenge sent by the switch. This can be a problem if one
CHAP user name and password have been compromised.
To restrict an initiator to use a specific user name for CHAP authentication, follow these steps:
Command
Step 1
switch# config t
switch(config)#
Step 2
switch(config)# islb initiator
name iqn.1987-02.com.cisco.init
switch(config-islb-init)#
Step 3
switch(config-islb-init)#
username user1
Mutual CHAP Authentication
In addition to the IPS module and MPS-14/2 module authentication of the iSLB initiator, the IPS module
and MPS-14/2 module also support a mechanism for the iSLB initiator to authenticate the Cisco MDS
switch's initiator target during the iSCSI login phase. This authentication requires the user to configure
a user name and password for the switch to present to the iSLB initiator. The provided password is used
to calculate a CHAP response to a CHAP challenge sent to the IPS port by the initiator.
Cisco MDS 9000 Family CLI Configuration Guide
43-48
ip-address 10.1.1.3
pwwn 22:00:00:04:cf:75:28:4d
pwwn 22:00:00:04:cf:75:ed:53
pwwn 22:00:00:04:cf:75:21:d5
pwwn 22:00:00:04:cf:75:ee:59
Chapter 34, "Configuring RADIUS and
43-23.
Purpose
Enters configuration mode.
Configures an iSLB initiator using the IQN of the initiator
node and enters iSLB initiator configuration mode.
Restricts the initiator
only authenticate using
Tip Be sure to define user1 as an iSCSI user in the local
AAA database or the RADIUS server.
Chapter 43 Configuring iSCSI
TACACS+"). AAA
"iSCSI Session
iqn.1987-02.com.cisco.init
as its CHAP user name.
user1
OL-18084-01, Cisco MDS NX-OS Release 4.x
to