Iscsi Session Authentication - HP Cisco MDS 9216 - Fabric Switch Configuration Manual

Configuring iSCSI
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
The IPS module or MPS-14/2 module uses the Fibre Channel virtual N port of the iSCSI host and does
a zone-enforced name server query for the Fibre Channel target WWN. If the FC ID is returned by the
name server, then the iSCSI session is accepted. Otherwise, the login request is rejected.

iSCSI Session Authentication

The IPS module or MPS-14/2 module supports the iSCSI authentication mechanism to authenticate the
iSCSI hosts that request access to the storage devices. By default, the IPS modules or MPS-14/2 modules
allow CHAP or None authentication of iSCSI initiators. If authentication is always used, you must
configure the switch to allow only CHAP authentication.
For CHAP user name or secret validation, you can use any method supported and allowed by the Cisco
MDS AAA infrastructure (see
authentication supports a RADIUS, TACACS+, or local authentication device.
To configure AAA authentication for an iSCSI user using Fabric Manager, follow these steps:
Step 1 Choose Switches > Security > AAA in the Physical Attributes pane.
You see the AAA configuration in the Information pane.
Click the Applications tab.
Step 2
You see the AAA configuration per application (see
Figure 50-26
Step 3 Right-click on the ServerGroup Id List field for the iSCSI application and enter the server group that you
want iSCSI to use.
Note
Click the Apply Changes icon to save these changes.
Step 4
The sections included in this topic are:
•
Cisco MDS 9000 Family CLI Configuration Guide
50-28
If the iSCSI target is an autogenerated iSCSI target, then the IPS module or MPS-14/2 module
extracts the WWN of the Fibre Channel target from the iSCSI target name and verifies if the initiator
and the Fibre Channel target is in the same Fibre Channel zone or not. If they are, then access is
allowed.
AAA per Application Configuration
You should use an existing server group or create a new server group before configuring it for
iSCSI session authentication.
Authentication Mechanism, page 50-29
Chapter 41, "Configuring RADIUS and
Figure
Chapter 50
TACACS+"). AAA
50-26).
OL-16184-01, Cisco MDS SAN-OS Release 3.x
Configuring iSCSI